Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

values/stage1.yaml

@@ -0,0 +1,15 @@
+# Local render-only values. Same isolated shape as the canary; no cluster apply.
+name: flex-auth-local
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true

values/stage2-canary.yaml

@@ -0,0 +1,16 @@
+# Isolated canary. Distinct Service name so production consumers never see it.
+# NetworkPolicy admits no ingress. Roll independently of the two production pins.
+name: flex-auth-canary
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true

values/stage3-production.yaml

@@ -0,0 +1,18 @@
+# Stage 3 values for the isolated canary release (flex-auth-canary).
+# Promoting this release does not move the production consumer pins.
+# Production pins live in values/user-engine.yaml and values/tenant-engine.yaml
+# and must be rolled independently.
+name: flex-auth-canary
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true

values/tenant-engine.yaml

@@ -0,0 +1,17 @@
+# Production pin for the tenant-engine policy service. Independently rollable.
+name: flex-auth-tenant-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/tenant-engine/policy_package.md
+consumer:
+  isolated: false
+  namespace: tenant-engine
+  podName: tenant-engine

values/user-engine.yaml

@@ -0,0 +1,17 @@
+# Production pin for the user-engine policy service. Independently rollable.
+name: flex-auth-user-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: false
+  namespace: user-engine
+  podName: user-engine