Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

charts/flex-auth/templates/rbac.yaml

@@ -0,0 +1,30 @@
+{{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "flex-auth.name" . }}-tokenreviewer
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "flex-auth.name" . }}-tokenreviewer
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "flex-auth.name" . }}-tokenreviewer
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flex-auth.name" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}