deploy: add verified secrets-engine production policy pin

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

values/secrets-engine.yaml

@@ -0,0 +1,21 @@
+# Dedicated secrets-engine policy service; CI build main-dd3ce4c.
+name: flex-auth-secrets-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/secrets-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/secrets-engine/policy_package.md
+callerAuth:
+  mode: warn
+  kubernetesURL: https://10.43.0.1
+  binding: secrets-engine=system:serviceaccount:secrets-engine:secrets-engine
+consumer:
+  isolated: false
+  namespace: secrets-engine
+  podName: secrets-engine