Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03)

ops-warden WARDEN-WP-0031 T04 minted audience-flex-auth tokens as
system:serviceaccount:ops-warden:ops-warden and held the warn-log count.
Helm rev 2 is enforce. Live probe 200/401/403. policy.enabled is theirs.

workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md

@@ -4,7 +4,7 @@ type: workplan
 title: "In-cluster ops-warden policy pin so policy.enabled can flip"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 owner: grok
 topic_slug: netkingdom
 planning_priority: P1
@@ -92,7 +92,7 @@ user-engine and tenant-engine pins were not moved.
 
 ```task
 id: FLEX-WP-0016-T03
-status: wait
+status: done
 priority: medium
 ```
 
@@ -103,5 +103,17 @@ the calling side; then this pin can enforce; then they set
 `~/.config/warden/warden.yaml`.
 
 Asked 2026-08-19. Cluster DNS from a warden workstation is not assumed;
-they pick tunnel or port-forward. `policy.py` posts JSON with no
-`Authorization` header.
+they pick tunnel or port-forward.
+
+WARDEN-WP-0031 T04 (2026-08-19): ServiceAccount `ops-warden/ops-warden`
+exists; `policy.caller_auth mode: command` mints `--audience flex-auth`
+per call; authenticated gate against warn held the warning count at 4
+(`decision:f3f7c88f9585582a`). They asked for enforce.
+
+**Enforce live 2026-08-19** Helm rev 2, same digest. Probe via port-forward
+`:19090` with `kubectl create token ops-warden -n ops-warden --audience flex-auth`:
+(1) Bearer → 200 `decision:49350f1064f674d7`;
+(2) no Authorization → **401** `unauthenticated`;
+(3) `resource.system=user-engine` → **403** `forbidden`.
+user-engine and tenant-engine pins were not moved. `policy.enabled` remains
+ops-warden's flip.