FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

decisions/decisions.md

@@ -2114,3 +2114,34 @@ without letting registry content decide an allow?
    were issued for user-engine's client, so an `application.access` rule that
    reads audience, authorized party or client-scoped roles answers for the
    wrong client. This is a package-review checklist item.
+
+---
+
+## FLEX-DEC-2026-020 — The binary is `access-engine`; `flex-auth` is a stub that names the rename
+
+**Date:** 2026-10-10
+**Status:** accepted (founder, 2026-10-10)
+**Workplan:** `FLEX-WP-0036-T01` (binary question), implemented in `T04`
+**Supersedes:** the "binary/CLI" row of `FLEX-DEC-2026-013`'s retain table
+
+**Question.** Should the binary be renamed outright, or ship as `access-engine`
+with a working `flex-auth` alias for one release?
+
+**Ruling.** Rename it outright. The CLI is `cmd/access-engine` and builds
+`access-engine`. `cmd/flex-auth` remains only as a stub: whatever it is called
+with, it prints that the binary was renamed to `access-engine` and exits 2.
+The image ships both, with the entrypoint set to `access-engine`. A working
+alias would keep the old name in use, and the rename exists to end that.
+
+**Consequences.**
+
+- Live pins are unaffected until their next roll. The chart passes only
+  `args`, so the new entrypoint takes the same subcommands.
+- A stale caller fails loudly with the new name instead of running.
+  Known callers to tell: `secrets-engine` (`tools/exercise_approval_identity.py`
+  builds `./cmd/flex-auth`), `net-kingdom` (protected-system runbook and
+  tutorial), and `informed-decision` (`docs/protected-browser-review.md`).
+- Runtime names are not covered by this ruling: the Go module path, the
+  `/opt/flex-auth` image paths, the caller audience, Kubernetes names and the
+  image package. They stay with `FLEX-WP-0036` T03 to T05 and their own order
+  (`FLEX-DEC-2026-015`).