Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

charts/flex-auth/values.yaml

@@ -0,0 +1,38 @@
+# Default chart values. Real pins live in values/*.yaml — never promote a tag.
+name: flex-auth
+namespace: flex-auth
+
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: ""
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/tenant-engine/policy_package.md
+
+service:
+  port: 8080
+
+health:
+  path: /healthz
+
+consumer:
+  isolated: false
+  namespace: ""
+  podName: ""
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 32Mi
+  limits:
+    cpu: 300m
+    memory: 192Mi