rotate: gitea LIVE-REAL — first real credential rotated (M2 rung 3)

First real-credential rotation on the safe-candidate ladder: full
create→verify→store→revoke against a real Gitea PAT on
git.churchofmalware.org (self-owned, no 2FA). To keep blast radius at
zero, the run targets a purpose-made THROWAWAY token — a genuine token
used by nothing — so the driver's real lifecycle earns LIVE-REAL without
risking any in-use PAT (which is also referenced across .git-credentials,
embedded git remotes and tea config, and needs the multi-reference
blast-and-cutover, still to build).

- lab/lab-rung3-gitea-real.sh: env-only secrets, isolated throwaway gopass
  store, independent cutover check (new->200, old->401), sealed backup.
- proofs.go + ROTATION-PROOFS.md: gitea promoted LIVE-VM -> LIVE-REAL,
  LIVE-REAL section added; "no driver carries this yet" removed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/ROTATION-PROOFS.md

@@ -26,7 +26,7 @@ Ordered lowest → highest (a higher level is a strictly stronger cutover proof)
 | **UNPROVEN** | No cutover proof recorded (e.g. the dry-run noop helper). |
 | **MOCK-ONLY** | Cutover proven only against an **emulator** — our own `httptest` / in-process SSH server, **or a third-party mock** (e.g. `moto` for AWS). **NOT** proven against the real target service. |
 | **LIVE-VM** | Cutover proven against the **real target software** running in the sandbox VM (real PostgreSQL / MariaDB / Redis / `wg` / Gitea / local files). |
-| **LIVE-REAL** | Cutover proven against a **real, host-owned credential at the real provider** (not the VM, not an emulator) — recorded only after an authorized per-credential rotation on the safe-candidate ladder (ROADMAP M2). **No driver carries this yet.** |
+| **LIVE-REAL** | Cutover proven against a **real, host-owned credential at the real provider** (not the VM, not an emulator) — recorded only after an authorized per-credential rotation on the safe-candidate ladder (ROADMAP M2). |
 
 > **Honesty note:** running in the VM does **not** automatically make a driver LIVE-VM.
 > AWS ran in the VM but only against **moto** (a mock AWS), so it is **MOCK-ONLY**. LIVE-VM
@@ -43,6 +43,18 @@ credential unattended.
 
 ## Current status
 
+### LIVE-REAL — proven against a real, host-owned credential at the real provider
+
+| Driver | Real credential | Proof |
+|------------|-----------------|-------|
+| `gitea` | real Gitea PAT on `git.churchofmalware.org` (self-owned, no 2FA) | `lab-rung3-gitea-real.sh` — full `create → verify → store → revoke` against a purpose-made throwaway token (2026-07-19). Independent cutover check: new token → `200`, old token → `401`; sealed backup verified; the driver-minted token deleted afterwards, leaving the account clean. |
+
+> **Ladder note (ROADMAP M2 rung 3):** this is the **first real credential rotation**. The
+> throwaway token was chosen so the driver's real lifecycle earns LIVE-REAL at **zero blast
+> radius** — a genuine in-use PAT is referenced in `~/.git-credentials`, embedded git-remote
+> URLs and `~/.config/tea/config.yml` as well as gopass, so rotating one safely first requires
+> the multi-reference **blast-and-cutover** (next work item), not just the single-blob driver.
+
 ### LIVE-VM — proven against real target software in the sandbox VM
 
 | Driver | Real target | Provisioner |
@@ -51,7 +63,6 @@ credential unattended.
 | `mysql` | real MariaDB | `lab-provision-dbclones.sh` |
 | `redis` | real `redis-server` | `lab-provision-dbclones.sh` |
 | `wireguard` | real `wg` | `lab-provision-wg.sh` |
-| `gitea` | real Gitea | `lab-provision-gitea.sh` |
 | `appsecret` | real local files | `lab-provision-appsec.sh` |
 | `mongo` | real `mongod` 8.0 | `lab-provision-mongo.sh` |
 | `k8s` | real k3s `v1.35` kube-apiserver | `lab-provision-k8s.sh` |