Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

charts/flex-auth/templates/serviceaccount.yaml

@@ -0,0 +1,9 @@
+{{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+automountServiceAccountToken: false
+{{- end }}