FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)

- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

workplans/FLEX-WP-0036-runtime-rename-access-engine.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time"
 domain: infotech
 repo: access-engine
-status: proposed
+status: active
 owner: claude
 topic_slug: netkingdom
 created: "2026-10-10"
@@ -65,7 +65,7 @@ written.
 
 ```task
 id: FLEX-WP-0036-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "4f9a796d-832f-5936-8a34-eb980f6e1b57"
 ```
@@ -78,6 +78,10 @@ ship `access-engine` with a `flex-auth` alias for one release.
 
 Gate: decision accepted by the founder.
 
+2026-10-10: binary settled by `FLEX-DEC-2026-020` (founder): renamed outright,
+`flex-auth` is a stub that prints the rename and exits 2. The other target
+names in the table still need the founder's acceptance.
+
 ## Inventory every consumer reference and open handoffs
 
 ```task
@@ -123,7 +127,7 @@ founder's go.
 
 ```task
 id: FLEX-WP-0036-T04
-status: todo
+status: progress
 priority: medium
 depends_on: [FLEX-WP-0036-T01]
 state_hub_task_id: "ff7fd369-326f-5044-aaa4-96c5f45c80e9"
@@ -137,6 +141,14 @@ until T07 is done, so the old pins can still roll back. No runtime change.
 Gate: build, tests and stage-1 render green; CI publishes both packages, and
 both resolve to the same digest.
 
+2026-10-10 binary part done ahead of the rest (`FLEX-DEC-2026-020`). The CLI is
+now `cmd/access-engine` and the image entrypoint is
+`/usr/local/bin/access-engine`. The image also ships the `flex-auth` stub.
+Updated: Makefile, CI, `tools/verify-posture.sh`, `tenancy.yaml` and the live
+docs. Workplans, decisions and ADRs are left as written. Still to do: the Go
+module, `FLEX_AUTH_*` env vars, the chart, the image package and the
+`/opt/flex-auth` paths.
+
 ## Stand up the access-engine namespace next to flex-auth
 
 ```task