Add native rotate and persistent lane overlay states

rotate replaces one declared KV field through the merge-safe patch path
and never prints the value. Overlay states active/suspended/deactivated/
compromised live under the evidence directory. compromise/reactivate and
successful suspend/deactivate/revoke update that overlay; exec/wrap/
handoff/provision refuse non-active lanes. Provider-side rotation stays
with rotation.owner. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

docs/hardening-backlog.md

@@ -66,11 +66,16 @@ contents in this repo.
 
 ## H4 — Rotation & lifecycle states
 
-- Implement `rotate` and persistent `compromised` / `deactivated` lane states
-  with evidence. Explicit suspend/deactivate/destroy plans now exist, and
-  ordinary `revoke` safely aliases native AppRole/policy deactivation, but lane
-  state and coordinated provider/workload rotation remain outstanding. Live
-  destroy remains disabled until exact-action authorization is available.
+- Implemented native `rotate`: merge-safe KV field replace from a mode-0600
+  file, sibling preservation, no argv values. Auth-capability lanes stay on
+  wrap/handoff. Provider/workload consumer rollout remains the catalog
+  `rotation.owner` duty.
+- Implemented persistent overlay states `active` / `suspended` /
+  `deactivated` / `compromised` under `evidence_dir/lane-state/` (non-secret,
+  not Git). `lifecycle compromise` / `reactivate` and successful
+  suspend/deactivate/revoke update the overlay. exec/wrap/handoff/provision
+  refuse non-active lanes; rotate remains allowed on compromised.
+- Live destroy remains disabled until exact-action authorization is available.
 
 ## H4a — Known-accessor operator command