FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

docs/ops-warden-registry-sync.md

@@ -26,7 +26,7 @@ from the same workstation:
 Start the runtime with the production registry snapshot and the ops-warden
 policy package:
 
-    flex-auth serve --addr 0.0.0.0:8080 --registry examples/ops-warden/production_registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /var/log/flex-auth/ops-warden-decisions.jsonl
+    access-engine serve --addr 0.0.0.0:8080 --registry examples/ops-warden/production_registry_snapshot.json --policy examples/ops-warden/policy_package.md --log /var/log/flex-auth/ops-warden-decisions.jsonl
 
 The checked-in production snapshot is a non-secret fixture and initial load
 target. Regenerate it from ops-warden inventory whenever actors, principals, or
@@ -68,7 +68,7 @@ Service if flex-auth should run inside the cluster.
 
 3. Validate the generated file before handoff:
 
-       flex-auth load-registry --file registry/flex-auth/production_registry_snapshot.json
+       access-engine load-registry --file registry/flex-auth/production_registry_snapshot.json
 
 4. Copy or promote the snapshot to the flex-auth runtime. For repo-level drift
    coverage, update examples/ops-warden/production_registry_snapshot.json when