Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

charts/flex-auth/templates/deployment.yaml

@@ -15,6 +15,9 @@ spec:
         {{- include "flex-auth.labels" . | nindent 8 }}
     spec:
       automountServiceAccountToken: false
+      {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+      serviceAccountName: {{ include "flex-auth.name" . }}
+      {{- end }}
       securityContext:
         runAsNonRoot: true
         seccompProfile:
@@ -25,6 +28,15 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             {{- toYaml .Values.args | nindent 12 }}
+            {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+            {{- $binding := required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
+            - --caller-auth-mode
+            - {{ include "flex-auth.callerAuth.mode" . | quote }}
+            - --caller-kubernetes-url
+            - {{ required "callerAuth.kubernetesURL is required when callerAuth.mode is warn or enforce" .Values.callerAuth.kubernetesURL | quote }}
+            - --caller-binding
+            - {{ $binding | quote }}
+            {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}
@@ -46,3 +58,25 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
+          {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+          volumeMounts:
+            - mountPath: {{ .Values.callerAuth.reviewer.mountPath }}
+              name: flex-auth-reviewer
+              readOnly: true
+          {{- end }}
+      {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+      volumes:
+        - name: flex-auth-reviewer
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  audience: {{ .Values.callerAuth.reviewer.audience | quote }}
+                  expirationSeconds: {{ .Values.callerAuth.reviewer.expirationSeconds }}
+                  path: token
+              - configMap:
+                  name: kube-root-ca.crt
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+      {{- end }}