globalDatabaseKey
internal fun globalDatabaseKey(databaseFile: File, rawKey: ByteArray, legacyKey: ByteArray?, rekey: DatabaseRekey = ::rekeyDatabase, onMigrated: () -> Unit): ByteArray
Returns the key the global database should be opened with, rekeying it to rawKey first if it is still on legacyKey.
Migration state is derived from the database itself rather than tracked in a flag: legacyKey is non-null only while the legacy alias is still stored, and a database that already opens with rawKey needs no rekey. That makes "rekeyed but the process died before the legacy alias was cleared" an ordinary path instead of a special case.
If the rekey fails but the legacy key still opens the database, availability wins and the legacy key is returned; a later process start retries.
Callers must serialize invocations for a given database file — a concurrent caller rekeying the same file would break an in-flight connection.