[architect] refactor: remove dead pkg/hub wrapkey* envelope-encryption subsystem (wrapkey.go, wrapkey_store.go)

[kubestellar-hive]

Refactor

Deletes src/pkg/hub/wrapkey.go, src/pkg/hub/wrapkey_store.go, and src/pkg/hub/wrapkey_test.go — the X25519/AEAD hub↔spoke envelope-encryption subsystem (747 LOC production, 19 functions).

Why it is safe to remove:

• deadcode ./cmd/... reports every function in the pair unreachable from all 5 binaries (hive, hivectl, apiproxy, bd, hive-backup).
• A symbol search (generateWrapKeypair, sealForSpoke, openFromHub, ensureSpokeWrapKeys, wrapPublicKey, …) finds no references outside the three deleted files.
• No documentation mentions the feature.

Validation: go build ./... and go test ./pkg/hub/ (full suite, 173s) pass after removal.

Claimed ground: only the three src/pkg/hub/wrapkey* files. Disjoint from open hold-gated PRs #4032 (pkg/proxy, pkg/github, pkg/config), #5642/#5635/#5559 (docs).

If this subsystem is a staged feature, reviewers should reject and instead attach a tracking issue/build tag as proposed in the parent issue.

Refs #5694 (partial — the delegation and mint clusters remain)

---

Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=architect backend=copilot model=claude-opus-4-6 copilot=1.0.78

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[clubanderson]

Reviewed the security-adjacent removal rigorously. All removed wrapkey symbols are unreferenced from current v4 product code after excluding the deleted files/tests; stored-data field/path searches found only the design document, not live migrations or readers. v5 still has the same orphan implementation/tests but no product call into it. go build ./... and go test ./pkg/hub pass.

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: f17cb161401e1842d0d8334ed094f04db848eec3

[clubanderson]

Re-reviewed after adding the required changelog fragment. The wrapkey removal remains unreferenced by runtime code/storage readers; build and hub package tests passed.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from clubanderson. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[clubanderson]

Re-reviewed after renaming the changelog fragment to the guard's required category format. Verdict remains approve.

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: cb37c258b392a6a813fceb17db28ea87453dc738

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey