Roll flex-auth-tenant-engine onto the FLEX-WP-0010 policy image

CI-built image from e9911eb, digest
sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7,
verified in a throwaway container before pinning and then probed again
against the live Service after rollout:

  tenant.retire    allow write_api_policy_matched  decision:491bbef2db999c02
  tenant.create    allow write_api_policy_matched  decision:fa3ba90e9cccb5aa
  tenant.retired   deny  unknown_action            decision:c5ee185de439ffe5
  unknown subject  deny  unknown_subject           decision:a98c59c6a34f84ad

tenant.retire has flipped from deny unknown_action to allow in
production, which is what TEN-WP-0005-T05 was waiting on.

Only flex-auth-tenant-engine was rolled. flex-auth-user-engine stays
pinned to a31961c4 -- its policy is unchanged and there is no reason to
move it. Previous tenant-engine digest kept in the runbook as the
rollback target.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md

@@ -15,6 +15,7 @@ related_workplans:
   - RAIL-BS-WP-0006
 created: "2026-08-11"
 updated: "2026-08-11"
+state_hub_workstream_id: "b17c3296-f8ae-4f61-bcf7-41ac80bacd47"
 ---
 
 # FLEX-WP-0011 - Bring flex-auth under the railiance staged-promotion contract
@@ -62,6 +63,7 @@ policy rollouts.
 id: FLEX-WP-0011-T01
 status: todo
 priority: medium
+state_hub_task_id: "edc7fee5-b78d-4a5c-a773-42c5b39d0019"
 ```
 
 Write `railiance/app.toml` against schema `railiance.app.v1`, using
@@ -88,6 +90,7 @@ set is accepted.
 id: FLEX-WP-0011-T02
 status: todo
 priority: medium
+state_hub_task_id: "5283bc1f-88c3-431b-a9ea-4a900a3e5885"
 ```
 
 Prove `stage deploy`, `stage observe`, `stage promote`, and `stage rollback`
@@ -104,6 +107,7 @@ evidence ids are recorded here.
 id: FLEX-WP-0011-T03
 status: todo
 priority: low
+state_hub_task_id: "bebd6ed9-9145-4fc0-bdc8-cac669643c62"
 ```
 
 `the-custodian/docs/coulombcore-drain-placement-plan.md` row 23 lists