browserrot(gitea): M-B4 LIVE-REAL — first real site-side password rotation

Rotated the self-owned Gitea login password end-to-end via the new
lab/rung4-gitea-browser harness: backup-gated (Hard Rule 1) -> pre-change
login(OLD) -> change-form submit -> new stored to gopass -> verified by
browser re-login AND independent API re-auth. GiteaSite promoted to
ProofLiveReal (proof-as-data).

Three real-site fixes surfaced by the live-fire:
- sites.go: Gitea login + "Update Password" buttons carry no type=submit
  ATTRIBUTE (only the default DOM property), so CSS [type=submit] misses;
  select by class / the account form's sole button instead.
- rod.go: Click now waits for the post-submit navigation to settle before
  the success text is read (a remote round-trip, unlike the instant
  in-process test) — else Text() resolves against the pre-submit page.
- rod.go: new RodDriver.Insecure (--ignore-certificate-errors) for the
  self-signed / Tailscale-fronted host (browser analog of curl -k).

Suite green + -race clean; docs (BROWSER-ROTATION.md §9, BROWSERROT-PLAN.md)
and OVERSEER-STATUS updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/BROWSER-ROTATION.md

@@ -318,10 +318,21 @@ adapter is pure-exec Go, so it is unit-validated cross-platform via an injected
   invalidates the old password itself. Proof-as-data per `Site`: the **ENGINE is LIVE-VM**
   (real headless Chromium against a real local change-password form —
   `lab-provision-browserrot.sh` / `TestIntegration_realBrowserRotation`); a **specific real-site
-  selector table stays UNPROVEN** until run against that real site, and no production `rotate`
-  wiring auto-enables it yet (still gated behind per-credential authorization). Still to do:
-  build out the curated selector table for real high-frequency no-MFA sites and measure the real
-  success rate before promising anything.
+  selector table stays UNPROVEN** until run against that real site. **First real-site promotion
+  done: `GiteaSite` is LIVE-REAL** — it drove a real password rotation of a self-owned Gitea
+  account (`trill-technician` @ `100.117.177.50:3030`) on 2026-07-21 via
+  `lab/rung4-gitea-browser` (M-B4): backup-gated (Hard Rule 1, 3 entries sealed+verified),
+  pre-change login with the OLD secret, change-form submit, then the NEW secret verified by
+  browser re-login AND independent API re-auth (HTTP 200). Two real-site selector fixes fell out
+  of the live-fire and are now in `sites.go`: (1) Gitea's login **and** "Update Password" buttons
+  carry no `type=submit` *attribute* (only the default DOM property), so CSS `[type=submit]`
+  misses — select by class / by the account form's sole button instead; (2) `RodDriver.Click`
+  now waits for the post-submit navigation to settle (a remote round-trip, unlike the instant
+  in-process test) before the success text is read. `RodDriver.Insecure` was added for the
+  self-signed/Tailscale host (browser analog of `curl -k`). No production `rotate` wiring
+  auto-enables browser rotation yet (still gated behind per-credential authorization; the
+  live-fire is a dedicated harness). Still to do: build out the curated selector table for other
+  real high-frequency no-MFA sites and measure the real success rate before promising anything.
 - **Phase A-tier-1.5 — Node stealth sidecar (built + LIVE-VM):** an optional swap-in
   `Driver` (`internal/browserrot/sidecar.go` + `internal/browserrot/sidecar/`) that speaks
   newline-delimited JSON-RPC over stdio to a small Node program driving a **patchright**