Epic: Elevation policy #520

Spec: 6.1-privilege-elevation.md
(status) ·
Neighbours: 6 owns the policy triplet,
6.2 owns the execution hosts,
2.6 places elevation among retry and error-action.

Elevation serves two substrates, and owes each a different answer:

1. Command execution — four providers run host commands (shell, powershell, pkg, service), and
   whether a given command needs elevation depends on the command and the host. The sometimes / sometimes
   not is already modelled as NeedsSudo(), and pkg/platform/helpers_unix.go inlines sudo -n under a
   standing TODO to route through this model.
2. Network access — providers that reach network resources and may need a credential to do so.

IdentityAssumption is the bridge: a broker-minted token can authorize a privileged command or be
injected into a network request. Elevation acquires a capability; the substrate consumes it.

The spec is not ready to build from. Everything below its supersession banner is marked design history:
the token-provider orchestrator, the self-registering drivers and the flat config shape all predate and
conflict with the settled config model (configuration.md) and the
settled broker model (3.2). Reconciling them is the first
work here.

Today's surface is a no-op. flow.Provider.Elevate() is empty, and op.ElevationOffer /
ElevationStrategy (pkg/op/elevation_policy.go) are plumbed but unconsumed.

Supersedes phase-8 step 38.