Implement inbound caller authentication (ADR 0004); close T03 and T05

TokenReview-based caller identity with audience-scoped tokens and exact
resource.system to ServiceAccount bindings, per ops-warden's recommendation.
Deletes the unwired tenant-engine live-roles adapter (T03) and adds
make verify-posture (T05). Source implements A2; running digest is still A0
until promotion, so tenancy.current.A stays 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/caller-auth-rbac.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flex-auth-tenant-engine
+  namespace: flex-auth
+automountServiceAccountToken: false
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flex-auth-user-engine
+  namespace: flex-auth
+automountServiceAccountToken: false
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: flex-auth-tokenreviewer
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: flex-auth-tenant-engine-tokenreviewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flex-auth-tokenreviewer
+subjects:
+- kind: ServiceAccount
+  name: flex-auth-tenant-engine
+  namespace: flex-auth
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: flex-auth-user-engine-tokenreviewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flex-auth-tokenreviewer
+subjects:
+- kind: ServiceAccount
+  name: flex-auth-user-engine
+  namespace: flex-auth

deploy/flex-auth-tenant-engine.yaml

@@ -14,6 +14,7 @@ spec:
         app.kubernetes.io/name: flex-auth-tenant-engine
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: flex-auth-tenant-engine
       containers:
       - args:
         - serve
@@ -23,6 +24,12 @@ spec:
         - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
         - --policy
         - /opt/flex-auth/examples/tenant-engine/policy_package.md
+        - --caller-auth-mode
+        - enforce
+        - --caller-kubernetes-url
+        - https://10.43.0.1
+        - --caller-binding
+        - tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
         image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc
         livenessProbe:
           httpGet:
@@ -51,10 +58,28 @@ spec:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/flex-auth-reviewer
+          name: flex-auth-reviewer
+          readOnly: true
       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
+      volumes:
+      - name: flex-auth-reviewer
+        projected:
+          defaultMode: 0440
+          sources:
+          - serviceAccountToken:
+              audience: https://kubernetes.default.svc
+              expirationSeconds: 3600
+              path: token
+          - configMap:
+              items:
+              - key: ca.crt
+                path: ca.crt
+              name: kube-root-ca.crt
 ---
 apiVersion: v1
 kind: Service
@@ -75,7 +100,12 @@ metadata:
   name: flex-auth-tenant-engine
   namespace: flex-auth
 spec:
-  egress: []
+  egress:
+  - ports:
+    - port: 443
+      protocol: TCP
+    - port: 6443
+      protocol: TCP
   ingress:
   - from:
     - namespaceSelector:

deploy/flex-auth-user-engine.yaml

@@ -14,6 +14,7 @@ spec:
         app.kubernetes.io/name: flex-auth-user-engine
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: flex-auth-user-engine
       containers:
       - args:
         - serve
@@ -23,6 +24,12 @@ spec:
         - /opt/flex-auth/examples/user-engine/registry_snapshot.json
         - --policy
         - /opt/flex-auth/examples/user-engine/policy_package.md
+        - --caller-auth-mode
+        - enforce
+        - --caller-kubernetes-url
+        - https://10.43.0.1
+        - --caller-binding
+        - user-engine=system:serviceaccount:user-engine:user-engine
         image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
         livenessProbe:
           httpGet:
@@ -51,10 +58,28 @@ spec:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/flex-auth-reviewer
+          name: flex-auth-reviewer
+          readOnly: true
       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
+      volumes:
+      - name: flex-auth-reviewer
+        projected:
+          defaultMode: 0440
+          sources:
+          - serviceAccountToken:
+              audience: https://kubernetes.default.svc
+              expirationSeconds: 3600
+              path: token
+          - configMap:
+              items:
+              - key: ca.crt
+                path: ca.crt
+              name: kube-root-ca.crt
 ---
 apiVersion: v1
 kind: Service
@@ -75,7 +100,12 @@ metadata:
   name: flex-auth-user-engine
   namespace: flex-auth
 spec:
-  egress: []
+  egress:
+  - ports:
+    - port: 443
+      protocol: TCP
+    - port: 6443
+      protocol: TCP
   ingress:
   - from:
     - namespaceSelector: