rotate: LIVE-REAL proof level + execute-time proof gate (M2)

Add ProofLiveReal (highest level, no driver yet) and enforce it at
execute time: rotate --execute only runs drivers with proof >= LIVE-VM
(MinExecuteProof). MOCK-ONLY/UNPROVEN drivers are skipped before any
provider call unless --allow-mock-proven is passed. ExecuteResult gains
Skipped/SkipReason; the CLI reports and audit-logs skips separately from
failures. Closes the last structural gap where an emulator-only driver
could touch a real credential unattended. Covered by execute_gate_test.go.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -66,12 +66,13 @@ paths proven at the CLI level.
 Rule (unchanged): **one credential at a time, explicit authorization per
 credential, verified backup + restore-drill first, verify-new-before-revoke-old.**
 
-- [ ] Add `ProofLiveReal` to `proofs.go` (+ docs mirror + PROOF column) so
-      promotions are recorded as data.
-- [ ] Policy gate in `execute.go`: `--execute` only runs drivers with proof ≥
-      LIVE-VM; MOCK-ONLY requires an explicit `--allow-mock-proven` opt-in flag.
-      Today nothing distinguishes them at execute time — closing this is the last
-      structural safety gap.
+- [x] Add `ProofLiveReal` to `proofs.go` (+ docs mirror + PROOF column) so
+      promotions are recorded as data. (Level added, ordered highest; no driver
+      carries it yet — filled by the ladder below.)
+- [x] Policy gate in `execute.go`: `--execute` only runs drivers with proof ≥
+      LIVE-VM (`MinExecuteProof`); MOCK-ONLY/UNPROVEN are SKIPPED (Rotate never
+      called) unless `--allow-mock-proven` is passed. Result rows carry
+      `Skipped`/`SkipReason`; covered by `execute_gate_test.go`.
 - [ ] Climb the ladder, promoting proofs as you go (lowest blast radius, fastest
       recovery first):
   1. **appsecret** — local file, trivially reversible.