Add native rotate and persistent lane overlay states

rotate replaces one declared KV field through the merge-safe patch path
and never prints the value. Overlay states active/suspended/deactivated/
compromised live under the evidence directory. compromise/reactivate and
successful suspend/deactivate/revoke update that overlay; exec/wrap/
handoff/provision refuse non-active lanes. Provider-side rotation stays
with rotation.owner. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

layer.yaml

@@ -60,6 +60,9 @@ protected_actions:
   - lifecycle-destroy
   - session-revoke
   - wrap
+  - rotate
+  - lifecycle-compromise
+  - lifecycle-reactivate
 
 # §13 proposed capabilities. Owner status is proposed, not assented, until
 # the surface exists in this repository's own contract.