FLEX-WP-0035-T04: application-readback pin values; lifecycle pin to v2 image

- values/application-readback.yaml: serve-readback, enforce, readback caller
  user-engine, ingress from user-engine only
- chart: readback.enabled renders --readback-caller instead of --caller-binding
- lifecycle pin to e8c57c18 (main-b5da745, lifecycle v2); previous bdac62bc
- TestReadbackPinMatchesParticipantPins: same image digest and package path

Founder go 2026-10-10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

charts/flex-auth/templates/deployment.yaml

@@ -45,11 +45,19 @@ spec:
             - {{ required "outbox.source is required when outbox.enabled=true" .Values.outbox.source | quote }}
             {{- end }}
             {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
-            {{- $binding := required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
+            {{- $binding := "" }}
+            {{- if not (and .Values.readback .Values.readback.enabled) }}
+            {{- $binding = required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
+            {{- end }}
             - --caller-auth-mode
             - {{ include "flex-auth.callerAuth.mode" . | quote }}
             - --caller-kubernetes-url
             - {{ required "callerAuth.kubernetesURL is required when callerAuth.mode is warn or enforce" .Values.callerAuth.kubernetesURL | quote }}
+            {{- if and .Values.readback .Values.readback.enabled }}
+            {{- /* serve-readback admits one readback caller and no /v1/check binding (FLEX-DEC-2026-019). */}}
+            - --readback-caller
+            - {{ required "readback.caller is required when readback.enabled=true" .Values.readback.caller | quote }}
+            {{- else }}
             - --caller-binding
             - {{ $binding | quote }}
             {{- range .Values.callerAuth.extraBindings }}
@@ -57,6 +65,7 @@ spec:
             - {{ . | quote }}
             {{- end }}
             {{- end }}
+            {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}

charts/flex-auth/values.yaml

@@ -40,6 +40,12 @@ consumer:
 
 # disabled keeps the image bootable without TokenReview (isolated canary).
 # Production pins set warn, then enforce, independently per consumer.
+# serve-readback pins (FLEX-WP-0035) admit one readback caller via
+# --readback-caller instead of --caller-binding.
+readback:
+  enabled: false
+  caller: ""
+
 callerAuth:
   mode: disabled
   audience: flex-auth