Implement inbound caller authentication (ADR 0004); close T03 and T05

TokenReview-based caller identity with audience-scoped tokens and exact
resource.system to ServiceAccount bindings, per ops-warden's recommendation.
Deletes the unwired tenant-engine live-roles adapter (T03) and adds
make verify-posture (T05). Source implements A2; running digest is still A0
until promotion, so tenancy.current.A stays 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/verify-posture.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+declaration="$root/tenancy.yaml"
+main="$root/cmd/flex-auth/main.go"
+
+axis_value() {
+  local block="$1" axis="$2"
+  awk -v block="$block" -v axis="$axis" '
+    $1 == block ":" { in_block=1; next }
+    in_block && $1 ~ /^(current|implemented|target):$/ { exit }
+    in_block && $1 == axis ":" { gsub(/[^0-9]/, "", $2); print $2; exit }
+  ' "$declaration"
+}
+
+current_a="$(axis_value current A)"
+implemented_a="$(axis_value implemented A)"
+current_i="$(axis_value current I)"
+implemented_i="$(axis_value implemented I)"
+declared_a="${implemented_a:-$current_a}"
+declared_i="${implemented_i:-$current_i}"
+
+fail() {
+  echo "posture drift: $*" >&2
+  exit 1
+}
+
+if grep -q 'authenticator.Authorize' "$main"; then
+  [[ "${declared_a:-0}" -ge 2 ]] || fail "caller authentication exists but current/implemented A is below 2"
+  for manifest in deploy/flex-auth-user-engine.yaml deploy/flex-auth-tenant-engine.yaml; do
+    grep -q -- '--caller-auth-mode' "$root/$manifest" || fail "$manifest omits caller auth mode"
+    grep -q 'enforce' "$root/$manifest" || fail "$manifest does not select enforce mode"
+    grep -q -- '--caller-binding' "$root/$manifest" || fail "$manifest omits the exact system binding"
+  done
+  [[ -f "$root/deploy/caller-auth-rbac.yaml" ]] || fail "TokenReview RBAC manifest is absent"
+else
+  [[ "${declared_a:-0}" -lt 2 ]] || fail "A2 is declared without a caller-authentication choke point"
+fi
+
+if grep -R --include='*.go' --exclude='*_test.go' -q 'tenantengine\.' "$root"; then
+  [[ "${declared_i:-0}" -ge 3 ]] || fail "tenant-engine is called but I3 is not declared"
+else
+  [[ "${declared_i:-0}" -lt 3 ]] || fail "I3 is declared without a non-test tenant-engine caller"
+fi
+
+if grep -qE '^    R: "?n/a"?' "$declaration"; then
+  for manifest in deploy/flex-auth-user-engine.yaml deploy/flex-auth-tenant-engine.yaml; do
+    ! grep -q -- '--log' "$root/$manifest" || fail "$manifest persists a decision log while R is n/a"
+    ! grep -q 'persistentVolumeClaim:' "$root/$manifest" || fail "$manifest mounts persistent storage while R is n/a"
+  done
+fi
+
+echo "posture declaration matches source and desired deployment controls"