Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

charts/flex-auth/templates/networkpolicy.yaml

@@ -11,7 +11,16 @@ spec:
   policyTypes:
     - Ingress
     - Egress
+  {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+  egress:
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+  {{- else }}
   egress: []
+  {{- end }}
   {{- if .Values.consumer.isolated }}
   ingress: []
   {{- else }}