Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred

flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after
tenant-engine 2063470 started sending a projected caller token
(sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04
cancelled: AuthZEN waits for a PEP we do not control.

tenancy.yaml

@@ -11,7 +11,7 @@ role: policy-decision-point
 tenancy:
   current:
     I: 1
-    A: 0
+    A: 2
     E: 1
     P: "n/a"
     R: "n/a"
@@ -39,12 +39,11 @@ tenancy:
       decision point judges asserted claims, it cannot be the verifier of its
       own inputs. Not a defect and not a target for movement.
     A: >-
-      flex-auth-user-engine is live A2 as of 2026-08-19: digest
-      sha256:138aa347…, callerAuth.mode=enforce, unbound request returns
-      401 and a cross-system token is 403. flex-auth-tenant-engine still
-      runs sha256:1bf060e6… with no caller authentication, so the service
-      declaration stays current A0 until that pin is warn-then-enforce.
-      Source and overlay implement A2 on both consumers.
+      Both production pins are live A2 as of 2026-08-19 on digest
+      sha256:138aa347… with callerAuth.mode=enforce. Unbound requests
+      return 401; a token bound to the other protected system returns 403.
+      user-engine probe from user-engine-8569d7cb87-fp7px;
+      tenant-engine probe from tenant-engine-6c6dcbddbb-4v26w.
     E: >-
       No tenant data at rest. Tenant scoping in decisions runs through one
       choke point (internal/decision/engine.go normalizeRequest and the