rotate: LIVE-REAL proof level + execute-time proof gate (M2)

Add ProofLiveReal (highest level, no driver yet) and enforce it at
execute time: rotate --execute only runs drivers with proof >= LIVE-VM
(MinExecuteProof). MOCK-ONLY/UNPROVEN drivers are skipped before any
provider call unless --allow-mock-proven is passed. ExecuteResult gains
Skipped/SkipReason; the CLI reports and audit-logs skips separately from
failures. Closes the last structural gap where an emulator-only driver
could touch a real credential unattended. Covered by execute_gate_test.go.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -66,12 +66,13 @@ paths proven at the CLI level.
 Rule (unchanged): **one credential at a time, explicit authorization per
 credential, verified backup + restore-drill first, verify-new-before-revoke-old.**
 
-- [ ] Add `ProofLiveReal` to `proofs.go` (+ docs mirror + PROOF column) so
-      promotions are recorded as data.
-- [ ] Policy gate in `execute.go`: `--execute` only runs drivers with proof ≥
-      LIVE-VM; MOCK-ONLY requires an explicit `--allow-mock-proven` opt-in flag.
-      Today nothing distinguishes them at execute time — closing this is the last
-      structural safety gap.
+- [x] Add `ProofLiveReal` to `proofs.go` (+ docs mirror + PROOF column) so
+      promotions are recorded as data. (Level added, ordered highest; no driver
+      carries it yet — filled by the ladder below.)
+- [x] Policy gate in `execute.go`: `--execute` only runs drivers with proof ≥
+      LIVE-VM (`MinExecuteProof`); MOCK-ONLY/UNPROVEN are SKIPPED (Rotate never
+      called) unless `--allow-mock-proven` is passed. Result rows carry
+      `Skipped`/`SkipReason`; covered by `execute_gate_test.go`.
 - [ ] Climb the ladder, promoting proofs as you go (lowest blast radius, fastest
       recovery first):
   1. **appsecret** — local file, trivially reversible.

docs/ROTATION-PROOFS.md

@@ -19,16 +19,28 @@ stops a mock-only driver from ever being mistaken for a live one.
 
 ## Levels
 
+Ordered lowest → highest (a higher level is a strictly stronger cutover proof):
+
 | Level | Meaning |
 |-----------|---------|
-| **LIVE-VM** | Cutover proven against the **real target software** running in the sandbox VM (real PostgreSQL / MariaDB / Redis / `wg` / Gitea / local files). |
-| **MOCK-ONLY** | Cutover proven only against an **emulator** — our own `httptest` / in-process SSH server, **or a third-party mock** (e.g. `moto` for AWS). **NOT** proven against the real target service. |
 | **UNPROVEN** | No cutover proof recorded (e.g. the dry-run noop helper). |
+| **MOCK-ONLY** | Cutover proven only against an **emulator** — our own `httptest` / in-process SSH server, **or a third-party mock** (e.g. `moto` for AWS). **NOT** proven against the real target service. |
+| **LIVE-VM** | Cutover proven against the **real target software** running in the sandbox VM (real PostgreSQL / MariaDB / Redis / `wg` / Gitea / local files). |
+| **LIVE-REAL** | Cutover proven against a **real, host-owned credential at the real provider** (not the VM, not an emulator) — recorded only after an authorized per-credential rotation on the safe-candidate ladder (ROADMAP M2). **No driver carries this yet.** |
 
 > **Honesty note:** running in the VM does **not** automatically make a driver LIVE-VM.
 > AWS ran in the VM but only against **moto** (a mock AWS), so it is **MOCK-ONLY**. LIVE-VM
 > means the *real* target software validated the cutover.
 
+### Execute-time proof gate
+
+`rotate --execute` runs a driver **only if its proof is ≥ LIVE-VM** (`MinExecuteProof`
+in `proofs.go`). MOCK-ONLY and UNPROVEN drivers are **skipped** — their
+`Rotate`/`Verify`/`RevokeOld` are never called, so the old secret is left fully intact —
+unless the operator passes the explicit **`--allow-mock-proven`** opt-in. This closes the
+last structural gap where a driver proven only against an emulator could touch a real
+credential unattended.
+
 ## Current status
 
 ### LIVE-VM — proven against real target software in the sandbox VM