FLEX-WP-0035-T04: application-readback pin values; lifecycle pin to v2 image

- values/application-readback.yaml: serve-readback, enforce, readback caller
  user-engine, ingress from user-engine only
- chart: readback.enabled renders --readback-caller instead of --caller-binding
- lifecycle pin to e8c57c18 (main-b5da745, lifecycle v2); previous bdac62bc
- TestReadbackPinMatchesParticipantPins: same image digest and package path

Founder go 2026-10-10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc

values/application-readback.yaml

@@ -0,0 +1,35 @@
+# FLEX-WP-0035-T04: advisory application access readback for user-engine.
+# Founder-approved 2026-10-10. Runs each participant's package from the same
+# image digest and path as that participant's own pin (contract §4); the test
+# TestReadbackPinMatchesParticipantPins enforces it.
+name: flex-auth-application-readback
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229
+args:
+- serve-readback
+- --addr
+- 0.0.0.0:8080
+- --registry
+- /opt/flex-auth/examples/application-readback/registry_snapshot.json
+- --registry
+- /opt/flex-auth/examples/informed-decision-lifecycle/registry.json
+- --package
+- informed-decision=/opt/flex-auth/examples/informed-decision-lifecycle/policy.md
+callerAuth:
+  mode: enforce
+  kubernetesURL: https://10.43.0.1
+readback:
+  enabled: true
+  caller: system:serviceaccount:user-engine:user-engine
+consumer:
+  isolated: false
+  namespace: user-engine
+  podName: user-engine
+resources:
+  requests:
+    cpu: 5m
+    memory: 32Mi
+  limits:
+    cpu: 300m
+    memory: 192Mi