FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

examples/ops-warden-fetch/README.md

@@ -56,7 +56,7 @@ The readable set is every ops-warden catalog entry with `status: active`,
 ```bash
 python3 tools/gen_ops_warden_fetch.py            # rewrites the three generated files
 python3 tools/gen_ops_warden_fetch.py --check    # exit 1 on drift (tests/stage1.sh runs it)
-go run ./cmd/flex-auth test-policy --file examples/ops-warden-fetch/policy_package.md
+go run ./cmd/access-engine test-policy --file examples/ops-warden-fetch/policy_package.md
 ```
 
 `--catalog PATH` overrides the default `~/ops-warden/registry/routing/catalog.yaml`.
@@ -67,9 +67,9 @@ baked into the image, so it needs a new image too (`deploy/README.md`).
 ## Verify
 
 ```bash
-go run ./cmd/flex-auth test-policy --file examples/ops-warden-fetch/policy_package.md   # 6 Rego tests, 15 fixtures
-go run ./cmd/flex-auth load-registry -file examples/ops-warden-fetch/registry_snapshot.json
-go test ./cmd/flex-auth -run OpsWardenFetch
+go run ./cmd/access-engine test-policy --file examples/ops-warden-fetch/policy_package.md   # 6 Rego tests, 15 fixtures
+go run ./cmd/access-engine load-registry -file examples/ops-warden-fetch/registry_snapshot.json
+go test ./cmd/access-engine -run OpsWardenFetch
 ```
 
 ## Not yet deployed