rotate: LIVE-REAL proof level + execute-time proof gate (M2)

Add ProofLiveReal (highest level, no driver yet) and enforce it at
execute time: rotate --execute only runs drivers with proof >= LIVE-VM
(MinExecuteProof). MOCK-ONLY/UNPROVEN drivers are skipped before any
provider call unless --allow-mock-proven is passed. ExecuteResult gains
Skipped/SkipReason; the CLI reports and audit-logs skips separately from
failures. Closes the last structural gap where an emulator-only driver
could touch a real credential unattended. Covered by execute_gate_test.go.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -48,9 +48,12 @@ credentials that legitimately require a human. See `docs/ROTATION.md` Part II.
   `rotate --execute` runs behind `INCREDIGO_ALLOW_EXECUTE=1` **and** the mandatory
   verified-backup gate (`Snapshot`). Proof status is DATA (`internal/rotate/proofs.go`
   mirrored in `docs/ROTATION-PROOFS.md`): **8 LIVE-VM** (postgres, mysql, redis,
-  mongo, wireguard, gitea, appsecret, k8s), **14 MOCK-ONLY**. **No real (host)
-  credential has been rotated yet** — every real rotation still requires explicit
-  per-credential authorization (safe-candidate ladder, ROADMAP M2).
+  mongo, wireguard, gitea, appsecret, k8s), **14 MOCK-ONLY**, plus a `LIVE-REAL`
+  level no driver carries yet. `--execute` enforces a proof gate: only drivers
+  with proof ≥ LIVE-VM (`MinExecuteProof`) run; MOCK-ONLY/UNPROVEN are skipped
+  unless `--allow-mock-proven` is passed. **No real (host) credential has been
+  rotated yet** — every real rotation still requires explicit per-credential
+  authorization (safe-candidate ladder, ROADMAP M2).
 - **Guided manual layer done:** `internal/links` + `internal/worklist` +
   `internal/tui` → `incredigo worklist` / `incredigo guide` (read-only).
 - **Phase B scaffolded, not wired:** 12 pwstore adapters, pwgen, staging;