real-money worker scaffolding (LIVE_ROLLOUT Phase 3 prep)

- start.sh: COPYBOT_ROLE=live — unarmed (missing LIVE_PRIVATE_KEY /
  LIVE_FUNDER_ADDRESS / LIVE_CONFIRM) idles in geocheck, no clone, no
  book, no orders; armed runs config.live.example.json + own state file
  copybot_state.live.json, --live, poll mode (webhook stays on paper).
- confirm_live: accepts the phrase from LIVE_CONFIRM env — the USER
  types it into flyctl secrets set (rule 0.7 human checkpoint, headless);
  wrong value aborts, unset disarms at next boot.
- config.live.example.json: Set E + pinned floors (mirrors paper),
  bankroll $50 @ 10% = $5 stakes, caps untouched (rule 0.6), leaked
  Discord webhook URL removed (ROTATE it — was committed publicly).
- fly.live.toml: separate app wwf-copybot-live, arn, no inbound, no
  checks, role env baked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

copytrade.py

@@ -599,6 +599,18 @@ def confirm_live(cfg):
           f" · daily cap ${cfg['risk']['daily_spend_cap_usd']:.0f}")
     print(f"  Watching {len(cfg['watchlist'])} wallets.")
     print("=" * 64)
+    # Headless arm (Fly live worker): the USER types the exact phrase into
+    # `flyctl secrets set LIVE_CONFIRM="…"` — still a human checkpoint, never
+    # baked into config or code (LIVE_ROLLOUT rule 0.7). Known property: while
+    # the secret stays set, restarts RE-ARM automatically (desired during the
+    # days-long Phase 5 matrix); `flyctl secrets unset LIVE_CONFIRM` disarms
+    # at the next boot, and any wrong value aborts instead of prompting.
+    env_phrase = os.environ.get("LIVE_CONFIRM")
+    if env_phrase is not None:
+        if env_phrase.strip() == CONFIRM_PHRASE:
+            print("confirmed via LIVE_CONFIRM env — armed.")
+            return
+        sys.exit("Aborted — LIVE_CONFIRM is set but does not match the phrase.")
     typed = input(f'Type "{CONFIRM_PHRASE}" to proceed (anything else aborts): ')
     if typed.strip() != CONFIRM_PHRASE:
         sys.exit("Aborted — not confirmed.")