[P1] Live verification — production submissions never tested

[Railly]

Context

All PRs #1-#9 verified against `e-beta.sunat.gob.pe` with the public Greenter test cert (RUC 20000000001). Production endpoint `e-factura.sunat.gob.pe` has NEVER been tested.

Same for SIRE: shapes match Manual v22 byte-for-byte but no live test. Same for GRE.

Scope

First production emission on a real RUC + cert:

1. Setup `CPE_PROFILE=prod-real` with real cert + clave SOL
2. `cpe doctor --driver sunat-direct` against prod
3. `cpe factura emit --params '{...}' --dry-run --mode prod` first
4. Tiny test factura (S/1 to a known RUC) with --yes
5. If accepted: validate CDR, void it via NC the same day to keep the test clean
6. Document results in a new `PROD-VERIFIED.md` (or just append to LIMITATIONS)

Same for

• Boleta ≥ S/700 individual
• Resumen Diario sendSummary (PR feat(cpe): boleta + resumen diario + comunicación de baja #2 was blocked by SUNAT beta WAF on test RUC; should work in prod)
• Comunicación de Baja
• NC/ND (PR feat(cpe): NC + ND end-to-end via sunat-direct, verified live #9)
• GRE (PR feat(gre): Guía de Remisión Electrónica REST API #7) with real GRE creds
• SIRE (PR feat(sire): RVIE Ventas + RCE Compras automation #4) with real RUC that has SIRE history

Success criteria

• LIMITATIONS.md "Producción ... never tested" line removed
• All ⚠️ entries in driver matrix → 🔬 production-verified
• Audit log shows successful prod CDR for each CPE type

Risks

• Cert leak if env vars get logged
• Plazo violation if the tiny test factura is forgotten and not voided same-day
• SUNAT throttle / rate limit not yet observed in prod

Why P1

Until this happens, the CLI is "demoware" — verified against beta only. P1 because nobody should run prod on unverified code.