FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

docs/application-access-readback.md

@@ -232,7 +232,7 @@ or revoke surface.
 ```bash
 # --registry and --package repeat once per participating system;
 # system ids must not repeat across registries.
-flex-auth serve-readback \
+access-engine serve-readback \
   --registry examples/<system>/registry_snapshot.json \
   --package <system>=examples/<system>/policy_package.md \
   --caller-auth-mode enforce \
@@ -243,4 +243,4 @@ The pin mounts `/healthz`, `POST /v1/readback/application_access` and
 `GET /v1/readback/systems`, and no enforcement route. `--readback-caller` is
 bound under the key `application-readback`. That key is not a protected
 system, so the principal can never represent a system on any pin's
-`/v1/check`. Tests: `cmd/flex-auth/readback_test.go`.
+`/v1/check`. Tests: `cmd/access-engine/readback_test.go`.