rotate: 4 SaaS-token/app-signing drivers + data-separated proof tracking

Add gitlab, cloudflare, ghactions (MOCK-ONLY) and appsecret (LIVE-VM) one-file
Rotators, each with a table-driven cutover-proof + leak-check test. gitlab/
cloudflare/ghactions are in-place SaaS-token rolls (self/rotate, value-roll,
sealed-secret overwrite) so RevokeOld is a no-op; ghactions seals via
nacl/box.SealAnonymous (no new go.mod dep). appsecret regenerates a local app
signing secret and rewrites it in place across every target file (atomic, mode-
preserving, redacted errors), discoverable via exact-match app-signing key names
in env.go.

Keep real-rotation code distinct from mock code: how each driver's cutover was
validated lives as DATA in internal/rotate/proofs.go (single source of truth) +
docs/ROTATION-PROOFS.md, surfaced as a PROOF column in `incredigo rotate` so a
MOCK-ONLY driver can never be mistaken for a LIVE-VM one. appsecret proven LIVE-VM
against real local files in the sandbox VM.

82 tests green, -race clean on rotate/sink/vault.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/discover/env.go

@@ -59,8 +59,18 @@ func (e *envScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, er
 			// regardless of the secret-ish heuristic: a weak/empty DB password is
 			// exactly the kind of leak we must not miss.
 			source, kind := e.Name(), Kind(KindToken)
+			secretBlob := val
 			if dbSrc := dbSourceForURL(val); dbSrc != "" {
 				source, kind = dbSrc, KindPassword
+			} else if appSigningKey(k) && len(val) >= 12 {
+				// An app SIGNING secret (Django SECRET_KEY, Rails secret_key_base, a
+				// JWT signing secret, …) lives in this very file; tag it Source=
+				// "appsecret" with a self-contained blob carrying the value AND its
+				// file path so the local in-place rotator is driver-ready.
+				source = "appsecret"
+				secretBlob = "appsecret://local/?" + url.Values{
+					"key": {k}, "val": {val}, "path": {p},
+				}.Encode()
 			} else if !looksSecret(k, val) {
 				continue
 			}
@@ -70,7 +80,7 @@ func (e *envScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, er
 				Identity: filepath.Base(p) + " / " + k,
 				Location: p,
 				Modified: fi.ModTime(),
-				Secret:   v.Store([]byte(val)),
+				Secret:   v.Store([]byte(secretBlob)),
 			})
 		}
 		f.Close()
@@ -104,6 +114,24 @@ func dbSourceForURL(val string) string {
 	return ""
 }
 
+// appSigningKeys are the env-var names that denote a local application SIGNING secret
+// — the kind the appsecret rotator can regenerate in place. Matched case-insensitively
+// and exactly (so STRIPE_API_KEY / DB_PASSWORD stay generic env secrets, not appsecrets).
+var appSigningKeys = map[string]bool{
+	"secret_key":        true, // Django / Flask
+	"secret_key_base":   true, // Rails
+	"django_secret_key": true,
+	"flask_secret_key":  true,
+	"app_key":           true, // Laravel
+	"app_secret":        true,
+	"jwt_secret":        true,
+	"session_secret":    true,
+	"nextauth_secret":   true,
+	"rails_secret":      true,
+}
+
+func appSigningKey(key string) bool { return appSigningKeys[strings.ToLower(key)] }
+
 func looksSecret(key, val string) bool {
 	lk := strings.ToLower(key)
 	for _, h := range sensitiveHints {

internal/discover/scanners_test.go

@@ -141,6 +141,61 @@ func TestEnvScanner(t *testing.T) {
 		"pgSECRET", "redisSECRET", "weak")
 }
 
+// TestEnvScannerAppSecret proves an app SIGNING secret (SECRET_KEY) is tagged
+// Source="appsecret" with a self-contained blob carrying its value AND file path, so
+// the local in-place rotator can Detect+Rotate it straight from a .env scan — while a
+// generic API key in the same file stays a plain env secret.
+func TestEnvScannerAppSecret(t *testing.T) {
+	dir := t.TempDir()
+	t.Chdir(dir)
+	appVal := "django-insecure-0123456789abcdefghijABCDEF"
+	writeFixture(t, filepath.Join(dir, ".env"),
+		"SECRET_KEY="+appVal+"\nSTRIPE_API_KEY=sk_live_keepGenericEnv00\n")
+
+	v := vault.New()
+	defer v.Purge()
+	creds, err := (&envScanner{}).Scan(context.Background(), v)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var app *Credential
+	for i := range creds {
+		if creds[i].Source == "appsecret" {
+			app = &creds[i]
+		}
+	}
+	if app == nil {
+		t.Fatalf("SECRET_KEY not tagged Source=appsecret; got %+v", creds)
+	}
+	if app.Identity != ".env / SECRET_KEY" {
+		t.Errorf("unexpected identity %q", app.Identity)
+	}
+
+	// The blob must round-trip the value AND the file path for the rotator.
+	buf, _ := v.Open(app.Secret)
+	u, err := url.Parse(strings.TrimSpace(string(buf.Bytes())))
+	if err != nil || u.Scheme != "appsecret" {
+		t.Fatalf("appsecret blob malformed: %v (%q)", err, string(buf.Bytes()))
+	}
+	if u.Query().Get("val") != appVal {
+		t.Error("appsecret blob does not carry the signing value")
+	}
+	if got := u.Query().Get("path"); !strings.HasSuffix(got, ".env") {
+		t.Errorf("appsecret blob path missing/wrong: %q", got)
+	}
+
+	// The generic API key in the same file must NOT be tagged appsecret.
+	for _, c := range creds {
+		if c.Source == "appsecret" && strings.Contains(c.Identity, "STRIPE") {
+			t.Error("generic API key wrongly tagged appsecret")
+		}
+	}
+
+	// Leak-check: the signing value must not appear in any non-secret field.
+	assertNoLeak(t, creds, appVal)
+}
+
 func TestNetrcScanner(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)