lab: rung-1 appsecret host dress rehearsal (M2 ladder)

First end-to-end run of the real rotate --execute spine on the host toolchain —
real gopass, mandatory backup gate, audit log, INCREDIGO_PASSPHRASE seal flow —
against a THROWAWAY scratch app (dummy .env + config.yml, fake SECRET_KEY) in an
isolated store. Walks dry-run -> blast -> execute, asserts the in-place cutover
(old value gone from both files, one identical new value written, stored blob
updated, sealed backup produced) and that the old value is recoverable from the
backup. Confirms the safety-relevant asymmetry: only plan/dry-run/blast scan the
host (read-only, noop); --execute sources ONLY gopass entries under --prefix, so
it can rotate nothing but the scratch entry.

appsecret stays LIVE-VM: the scratch secret is fake, so this proves the host flow,
not a real credential. Promotion to LIVE-REAL is reserved for a real-cred rotation
with explicit per-credential authorization.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lab/README.md

@@ -61,6 +61,14 @@ multipass exec incredigo-sbx -- bash -lc '
 
 ## Custody / smoke
 
+- `lab-rung1-appsecret-host.sh` — **safe-candidate ladder rung 1**, the host dress
+  rehearsal: the first end-to-end run of the real `rotate --execute` spine on the host
+  toolchain (real gopass, backup gate, audit, seal flow) against a **throwaway scratch
+  app** (dummy `.env` + `config.yml`, fake secret). Walks dry-run → blast → execute →
+  asserts the in-place cutover (old gone, one new value in both files, stored blob
+  updated) → shows the old value is recoverable from the sealed backup. Isolated store,
+  zero real-cred risk. `appsecret` stays LIVE-VM — a real-cred rotation is what earns
+  LIVE-REAL. (ROADMAP M2 rung 1.)
 - `lab-restore-drill.sh` — proves the sealed `.age` backup is a **real recovery path** on
   the host against real gopass (isolated throwaway store, fake creds): seed → seal →
   destroy every entry → `import` → assert byte-equal restoration + no plaintext in the