A security auditor asks you to confirm whether SELinux is actively enforcing policy on a production RHEL server right now, without changing any configuration or rebooting. Which command reports the current runtime enforcement mode in a single word?