Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

tests/stage1.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Stage 1 overlay render: contract + helm template of every independently
+# rollable values file. Does not contact the cluster.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+python3 tests/validate_app_toml.py
+
+for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
+              values/user-engine.yaml values/tenant-engine.yaml; do
+  echo "helm template ${values}"
+  helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
+done
+
+echo "stage1 overlay render ok"

tests/validate_app_toml.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Validate railiance/app.toml against the railiance.app.v1 schema."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CONTRACT = ROOT / "railiance" / "app.toml"
+SCHEMA_CANDIDATES = [
+    Path.home() / "railiance-bootstrap" / "schemas" / "railiance-app.schema.json",
+    Path.home() / "railiance-cluster" / "schemas" / "railiance-app.schema.json",
+]
+
+
+def main() -> int:
+    schema_path = next((path for path in SCHEMA_CANDIDATES if path.exists()), None)
+    if schema_path is None:
+        print("railiance-app.schema.json not found in railiance-bootstrap or railiance-cluster", file=sys.stderr)
+        return 1
+    try:
+        import jsonschema
+    except ImportError:
+        print("python3-jsonschema is required to validate railiance/app.toml", file=sys.stderr)
+        return 1
+
+    document = tomllib.loads(CONTRACT.read_text())
+    schema = json.loads(schema_path.read_text())
+    jsonschema.validate(document, schema)
+    print(f"valid {CONTRACT.relative_to(ROOT)} against {schema_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())