Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.

values/user-engine.yaml

@@ -0,0 +1,17 @@
+# Production pin for the user-engine policy service. Independently rollable.
+name: flex-auth-user-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: false
+  namespace: user-engine
+  podName: user-engine