Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

values/tenant-engine.yaml

@@ -0,0 +1,17 @@
+# Production pin for the tenant-engine policy service. Independently rollable.
+name: flex-auth-tenant-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/tenant-engine/policy_package.md
+consumer:
+  isolated: false
+  namespace: tenant-engine
+  podName: tenant-engine