[imanimanyara]

A hosting-panel target (ploi, forge, cpanel) only accepts a pasted key, and before this PR rotate handled it badly. The provider's Deploy just printed "paste the key at …" and its Verify always returned false, so rotate either:

• aborted, leaving the old key in place, or
• with --allow-unverified, committed before the key was pasted, so SSH to that server failed until it was (or until rollback).

Now, at a terminal

1. rotate shows the staged public key and where it goes, and waits.
2. After the user confirms the paste, it logs in with the staged key itself (ssh -i <staged> -o IdentitiesOnly=yes … true).
3. Only a working login counts as verified. A failed login, or answering n, discards the staged key and leaves the old one active.

What else changes

• A committed report names where the old key still has to be removed from the panel; until then it still logs in.
• Only panel providers are proven by logging in. A git host refuses a shell even for a valid key, so vcs web-panel entries still need --allow-unverified.
• The 1Password key-store path gets the same step.
• Without a terminal, nothing changes: such a target still aborts unless --allow-unverified.

Tests

• Four rotator tests: pasted and proven commits without --allow-unverified; a failed proof doesn't commit and leaves the active key byte-identical; declining stops before any SSH; the report names where to remove the old key.
• The proof is checked to use the staged key and the host's user.
• They fail with the fix removed (checked), and existing tests pass unchanged.

Verified locally

• gofmt, go vet and make e2e pass.
• The full test suite's failures are byte-identical to the known sandbox baseline: the same 10 local-socket tests.

Docs: docs/tools/rotate.md, docs/recipes/rotate-a-key.md, the feature catalog and the CHANGELOG ([Unreleased] → Fixed).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.