fix: require signature invalidation in live rotation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102

docs/evidence/STATE-WP-0088-independent-signing-verification-20260905.json

@@ -0,0 +1,21 @@
+{
+  "schema": "state-hub.signing-runtime-acceptance.v1",
+  "health": "passed",
+  "signed_preflight": true,
+  "replicas": 1,
+  "secret_resource_version": "57239554",
+  "pods": [
+    {
+      "pod_uid": "cff7074b-5d15-40b9-8c14-68c1c3ab05c3",
+      "accepted_key_version": true,
+      "predecessor_rejected": true
+    }
+  ],
+  "repository_mutations": 0,
+  "date": "2026-09-05",
+  "task": "STATE-WP-0088-T02",
+  "platform_task": "RPF-WP-0035-T04",
+  "verified_kv_version": 2,
+  "predecessor_rejection": "signature; expiry alone is rejected by the verifier",
+  "platform_evidence": "railiance-platform/docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json"
+}