Rotate the Amp provider token

Orb state lives in the Worker, so a token swap loses none. Jobs that arrive while the provider restarts wait in Amp, which offers unclaimed jobs again.

Make a new token
In Amp, go to Settings → Orbs → your provider and create a new token. Keep the old one for now.
Put the new token in place
In Cloudflare provider mode, write the new token to a file with mode 600, then run:
```
npx cf-orbs init --token-file <file>
```
init sets the Worker secret and asks the Worker to start the provider. The Worker sees a different token hash, so it stops the old container and starts a new one. If that doesn’t happen, the next cron or alarm (5 min at most) does the swap.
In external mode, edit /etc/cf-orbs/provider.env, then run sudo systemctl restart cf-orbs-provider.
Check
Run npx cf-orbs status and look for a new start time and no rejected line. You can also run npx cf-orbs logs --provider.
Revoke the old token
Revoke the old token in Amp.

If status still shows the old start time after 10 min, the Durable Object may still run old Worker code. This path is not yet tested on a live install. Run cf-orbs deploy, wait 2 min, and check again. If it happens again, report it on GitHub.

If Amp rejects the token

The provider log shows Error: Amp rejected the orb provider token, and init stops with:

Failed: Amp rejected the provider token (wrong or revoked) — fix: create a token in Amp Settings → Orbs → your provider, then cf-orbs init --token-file <file>

Make a new token and run init with it.