Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

values/stage2-canary.yaml

@@ -0,0 +1,16 @@
+# Isolated canary. Distinct Service name so production consumers never see it.
+# NetworkPolicy admits no ingress. Roll independently of the two production pins.
+name: flex-auth-canary
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true