browserrot(gitea): M-B4 LIVE-REAL — first real site-side password rotation

Rotated the self-owned Gitea login password end-to-end via the new
lab/rung4-gitea-browser harness: backup-gated (Hard Rule 1) -> pre-change
login(OLD) -> change-form submit -> new stored to gopass -> verified by
browser re-login AND independent API re-auth. GiteaSite promoted to
ProofLiveReal (proof-as-data).

Three real-site fixes surfaced by the live-fire:
- sites.go: Gitea login + "Update Password" buttons carry no type=submit
  ATTRIBUTE (only the default DOM property), so CSS [type=submit] misses;
  select by class / the account form's sole button instead.
- rod.go: Click now waits for the post-submit navigation to settle before
  the success text is read (a remote round-trip, unlike the instant
  in-process test) — else Text() resolves against the pre-submit page.
- rod.go: new RodDriver.Insecure (--ignore-certificate-errors) for the
  self-signed / Tailscale-fronted host (browser analog of curl -k).

Suite green + -race clean; docs (BROWSER-ROTATION.md §9, BROWSERROT-PLAN.md)
and OVERSEER-STATUS updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/BROWSERROT-PLAN.md

@@ -1,9 +1,13 @@
 # browserrot buildout plan — Node stealth sidecar + AI self-heal (Phase A tiers 1-3)
 
-**Status (2026-07-19):** M-B1 ✅ M-B2 ✅ M-B3 ✅ (all LIVE-VM proven against the local lab
-form, `internal/browserrot/` suite green + `-race` clean). **M-B4 (first REAL self-owned
-site) deliberately NOT started** — it rotates a real credential and needs explicit
-per-credential authorization (safe-candidate ladder). M-B5 (vision) later. The Stagehand
+**Status (2026-07-21):** M-B1 ✅ M-B2 ✅ M-B3 ✅ **M-B4 ✅** (first REAL self-owned site).
+M-B1..B3 are LIVE-VM against the local lab form; **M-B4 is LIVE-REAL** — `GiteaSite` drove a
+real password rotation of a self-owned Gitea account (`trill-technician` @
+`100.117.177.50:3030`) on 2026-07-21 via `lab/rung4-gitea-browser`, backup-gated and verified
+by browser re-login + API re-auth (HTTP 200). Two real-site selector fixes landed from the
+live-fire (no `type=submit` attribute on Gitea buttons; `RodDriver.Click` now waits for the
+post-submit navigation), plus `RodDriver.Insecure` for the self-signed/Tailscale host. The
+`internal/browserrot/` suite is green + `-race` clean. M-B5 (vision) later. The Stagehand
 (LLM) heal strategy is wired but UNPROVEN/opt-in; the deterministic DOM-heuristic heal is
 the LIVE-VM Tier-2. See `docs/BROWSER-ROTATION.md` §9 for the proof-as-data record.
 **Extends, does not replace:** [`docs/BROWSER-ROTATION.md`](BROWSER-ROTATION.md) (the design
@@ -142,10 +146,12 @@ Per-`Site` `Proof`:
   selector miss → rewrite + persist the recipe → next run is Tier-1. Test: seed a *broken*
   selector, assert one run heals it and the second run needs no LLM. Assert **no secret** in any
   heal request (leak-check the IPC transcript).
-- **M-B4 — record command + first REAL site.** `incredigo browser record`; then point the
-  engine at ONE real self-owned account (low-stakes, no MFA), rotate + re-login-verify, promote
-  that host to LIVE-REAL. New `lab/`/runbook entry, per-cred authorization (safe-candidate
-  ladder discipline).
+- **M-B4 — record command + first REAL site. ✅ DONE (2026-07-21, rotation half).** Pointed the
+  engine at ONE real self-owned account (self-hosted Gitea, no MFA), rotated + re-login-verified,
+  promoted `GiteaSite` to LIVE-REAL. Harness: `lab/rung4-gitea-browser` (env-only secrets,
+  isolated to the real gopass entry `gitea/login-creds`, `MODE=probe|live`, `GITEA_INSECURE=1`
+  for the self-signed host). Backup-gated (Hard Rule 1). The `incredigo browser record` codegen
+  command is still TODO — this run used the curated `GiteaSite` recipe, not a recorded one.
 - **M-B5 (optional/later) — vision fallback.** Tier-3 Computer Use for hostile markup; secrets
   injected locally, never to the model.