Prepare signed lifecycle runtime admission and receipt verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

tenancy.yaml

@@ -11,8 +11,16 @@ role: policy-decision-point
 workload_identity:
   name: flex-auth
   kind: platform-service
-  responsible_repo: flex-auth
+  responsible_repo: access-engine
   identity_bindings:
+    # Existing retained Secrets PDP pin; identity source, not key admission.
+    - scheme: kubernetes-service-account
+      authority: railiance01
+      subject: system:serviceaccount:flex-auth:flex-auth-secrets-engine
+      principal_type: service
+      environment: prod
+      evidence:
+        - docs/native-signer-workload.json
     - scheme: kubernetes-service-account
       authority: railiance01
       subject: system:serviceaccount:flex-auth:flex-auth-ops-warden