rotate: promote k8s + mongo to LIVE-VM via real-target POCs

Ran live cutover POCs in the sandbox VM against the real target software and
promoted both drivers from MOCK-ONLY to LIVE-VM in the proof table (data, not
driver behaviour):

- k8s: proven against real k3s v1.35 kube-apiserver + token controller
  (lab-provision-k8s.sh). The real apiserver serves a self-signed cert, so the
  driver gained CA-pinned TLS — blob params ca= (base64 PEM, pinned as the only
  trusted root) and insecure=1 (lab-only escape hatch), routed through a new
  clientFor(cr). Neither is test-awareness; a real deployment configures the same
  CA. Added TestK8sTLSTrust covering CA-pinned / insecure / untrusted-rejection
  and the blob round-trip.
- mongo: proven against real mongod 8.0 (lab-provision-mongo.sh).

npm stays MOCK-ONLY by decision (registry.npmjs.org not self-hostable; real
create-token requires the account password in the body) — documented as a
contract gap rather than faking a LIVE-VM. gcp/twilio/flyio remain MOCK-ONLY.

Live POCs surfaced real-target-only behaviour now recorded in the docs: the
apiserver's ~10s successful-auth cache (old token kept working ~7s after Secret
deletion) and real mongosh's stdout prompt. Full suite 104 green, -race clean.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/FINDINGS-2026-06-16.md

@@ -290,14 +290,30 @@ just an `HTTPClient`/`Bin`), validated against protocol-enforcing emulators:
   for the controller to populate `.data.token`, GETs the SA to verify, then DELETEs the old
   Secret (which invalidates the old token).
 
-**All 6 are MOCK-ONLY** — honestly, because they were proven only against emulators. mongo,
-npm and k8s are LIVE-VM *candidates* (real MongoDB / a throwaway npm registry / a k3s cluster
-would promote them with zero driver-code change), but per the standing rule a driver is only
-LIVE-VM after the *real target* validates the cutover, so they stay MOCK-ONLY until those VM
-POCs run. Each emulator enforces credential validity and the tests assert `Verify(old)` fails
+Each emulator enforces credential validity and the tests assert `Verify(old)` fails
 after revoke, plus a leak canary (no token/secret/`PRIVATE KEY` in Identity/Source/Location).
 
-Full suite after batch 2: **103 green**, `-race` clean on rotate/sink/vault.
+### Live-VM POCs run (2026-06-18/19) → mongo + k8s promoted to LIVE-VM
+
+- **mongo → LIVE-VM** (`lab-provision-mongo.sh`): real `mongod` 8.0 from the official apt
+  repo; `labapp` (admin, `userAdminAnyDatabase`) rotates its own password; old password
+  rejected, new works. *Surfaced by the real target:* real `mongosh` echoes a `labdb> ` prompt
+  to stdout on a pipe and `db.auth` returns an object not a bool in 2.8 — the fake-mongosh stub
+  did neither, so the assertion had to filter output to the `AUTH-OK`/`AUTH-FAIL` token.
+- **k8s → LIVE-VM** (`lab-provision-k8s.sh`): real **k3s v1.35** kube-apiserver + token
+  controller; `labsa` (RBAC: create/delete/get Secrets + get its SA) rotates its legacy
+  token Secret; old token → `401`, new → `200`. *Surfaced by the real target:* (a) the
+  apiserver serves a self-signed cert, so the driver needed CA-pinned TLS — added `ca=`
+  (base64 PEM) + an `insecure=1` lab-only escape hatch to the blob; (b) the apiserver caches
+  *successful* auths ~10s (`cachedTokenAuthenticator`), so the deleted token kept working until
+  the cache expired (~7s) — the POC polls past it. Both are real-deployment config, not
+  test-awareness.
+- **npm stays MOCK-ONLY** (decided, not pending): `registry.npmjs.org` isn't self-hostable and
+  real `POST /-/npm/v1/tokens` requires the **account password in the body** (the driver sends
+  only Bearer old-token). Documented as a contract gap in `docs/ROTATION-PROOFS.md` rather than
+  faking a LIVE-VM. gcp/twilio/flyio remain MOCK-ONLY (no self-host).
+
+Full suite after batch 2 + POCs: **104 green**, `-race` clean on rotate/sink/vault.
 
 ## Summary