Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

Makefile

@@ -4,7 +4,7 @@ PKG     := ./...
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo 0.0.0-dev)
 LDFLAGS := -X main.version=$(VERSION)
 
-.PHONY: all build test vet lint fmt tidy sbom clean ci
+.PHONY: all build test vet lint fmt tidy sbom clean ci overlay-render overlay-dry-run
 
 all: vet lint test build
 
@@ -56,4 +56,15 @@ sbom:
 clean:
 	rm -rf $(BIN_DIR)
 
-ci: vet lint test build
+ci: vet lint test build overlay-render
+
+overlay-render:
+	@tests/stage1.sh
+
+overlay-dry-run:
+	@test -n "$$KUBECONFIG" || { echo "set KUBECONFIG to the railiance01 kubeconfig"; exit 1; }
+	@for values in values/stage2-canary.yaml values/user-engine.yaml values/tenant-engine.yaml; do \
+		echo "server-dry-run $$values"; \
+		helm template flex-auth charts/flex-auth -f "$$values" --namespace flex-auth \
+		  | kubectl apply --dry-run=server --server-side -f -; \
+	done