Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

tests/stage1.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Stage 1 overlay render: contract + helm template of every independently
+# rollable values file. Does not contact the cluster.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+python3 tests/validate_app_toml.py
+
+for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
+              values/user-engine.yaml values/tenant-engine.yaml; do
+  echo "helm template ${values}"
+  helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
+done
+
+echo "stage1 overlay render ok"