Add native rotate and persistent lane overlay states

rotate replaces one declared KV field through the merge-safe patch path
and never prints the value. Overlay states active/suspended/deactivated/
compromised live under the evidence directory. compromise/reactivate and
successful suspend/deactivate/revoke update that overlay; exec/wrap/
handoff/provision refuse non-active lanes. Provider-side rotation stays
with rotation.owner. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

src/secrets_engine/evidence_class.py

@@ -45,6 +45,9 @@ SHIPPED_RULES = (
             "provision",
             "session-revoke",
             "wrap",
+            "rotate",
+            "lifecycle-compromise",
+            "lifecycle-reactivate",
         ),
         "stages": ("prod",),
     },