Prepare signed lifecycle runtime admission and receipt verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

charts/flex-auth/templates/deployment.yaml

@@ -83,6 +83,8 @@ spec:
             {{- if not (and .Values.readback .Values.readback.enabled) }}
             {{- $binding = required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
             {{- end }}
+            - --caller-audience
+            - {{ required "callerAuth.audience is required" .Values.callerAuth.audience | quote }}
             - --caller-auth-mode
             - {{ include "flex-auth.callerAuth.mode" . | quote }}
             - --caller-kubernetes-url