FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

SCOPE.md

@@ -99,7 +99,7 @@ can be coordinated behind a stable flex-auth API.
 The standalone core is implemented and **all seven baseline workplans
 (`FLEX-WP-0001` through `FLEX-WP-0007`) are complete.** The repository carries
 the intent baseline, authorization landscape research, ADR set, and a working
-Go service (`cmd/flex-auth`) with `validate`, `load-registry`, `serve`, and
+Go service (`cmd/access-engine`) with `validate`, `load-registry`, `serve`, and
 `POST /v1/check` plus registry, policy, decision, audit, Markitect, and
 delegated-adapter internals. The standalone policy-as-code core (`FLEX-WP-0002`),
 Markitect consumer integration (`FLEX-WP-0003`, manifest ingest, decisions, and