Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

charts/flex-auth/templates/networkpolicy.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress: []
+  {{- if .Values.consumer.isolated }}
+  ingress: []
+  {{- else }}
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ required "consumer.namespace is required when not isolated" .Values.consumer.namespace }}
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ required "consumer.podName is required when not isolated" .Values.consumer.podName }}
+      ports:
+        - port: {{ .Values.service.port }}
+          protocol: TCP
+  {{- end }}