Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

charts/flex-auth/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: flex-auth
+description: Independently rollable flex-auth policy-decision Deployment (one consumer per release).
+type: application
+version: 0.1.0
+appVersion: "0.1.0"

charts/flex-auth/templates/_helpers.tpl

@@ -0,0 +1,20 @@
+{{- define "flex-auth.image" -}}
+{{- if not .Values.image.digest }}
+{{- fail "image.digest is required (digest_policy=required); do not deploy by tag" }}
+{{- end }}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- end -}}
+
+{{- define "flex-auth.name" -}}
+{{- required "name is required" .Values.name -}}
+{{- end -}}
+
+{{- define "flex-auth.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "flex-auth.name" . }}
+{{- end -}}
+
+{{- define "flex-auth.labels" -}}
+{{ include "flex-auth.selectorLabels" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: flex-auth
+{{- end -}}

charts/flex-auth/templates/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "flex-auth.labels" . | nindent 8 }}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: flex-auth
+          image: {{ include "flex-auth.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            {{- toYaml .Values.args | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.health.path }}
+              port: http
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.health.path }}
+              port: http
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true

charts/flex-auth/templates/networkpolicy.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress: []
+  {{- if .Values.consumer.isolated }}
+  ingress: []
+  {{- else }}
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ required "consumer.namespace is required when not isolated" .Values.consumer.namespace }}
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ required "consumer.podName is required when not isolated" .Values.consumer.podName }}
+      ports:
+        - port: {{ .Values.service.port }}
+          protocol: TCP
+  {{- end }}

charts/flex-auth/templates/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  selector:
+    {{- include "flex-auth.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http

charts/flex-auth/values.yaml

@@ -0,0 +1,38 @@
+# Default chart values. Real pins live in values/*.yaml — never promote a tag.
+name: flex-auth
+namespace: flex-auth
+
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: ""
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/tenant-engine/policy_package.md
+
+service:
+  port: 8080
+
+health:
+  path: /healthz
+
+consumer:
+  isolated: false
+  namespace: ""
+  podName: ""
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 32Mi
+  limits:
+    cpu: 300m
+    memory: 192Mi