Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

charts/flex-auth/values.yaml

@@ -29,6 +29,18 @@ consumer:
   namespace: ""
   podName: ""
 
+# disabled keeps the image bootable without TokenReview (isolated canary).
+# Production pins set warn, then enforce, independently per consumer.
+callerAuth:
+  mode: disabled
+  audience: flex-auth
+  kubernetesURL: https://kubernetes.default.svc
+  binding: ""
+  reviewer:
+    mountPath: /var/run/secrets/flex-auth-reviewer
+    audience: https://kubernetes.default.svc
+    expirationSeconds: 3600
+
 resources:
   requests:
     cpu: 25m