Record production gap for FLEX-WP-0010 and re-probe FLEX-WP-0009

FLEX-WP-0010-T04: the deployed flex-auth-tenant-engine Deployment bakes
the policy package into its image, so production still serves the
four-action policy -- probed live, tenant.retire returns deny
unknown_action there while tenant.create allows. TEN-WP-0005-T05 is
unblocked in source but needs an image build from 8e127e5 and a rollout,
which this workplan does not scope. Stated in the workplan and in
examples/tenant-engine/README.md rather than left implied.

FLEX-WP-0009-T04: replayed all six user-engine fixtures against the
deployed flex-auth-user-engine service; all six matched expected effect
and reason, confirming the deployed failure matrix is still fail-closed.
T04 stays in progress -- the criterion also requires user-engine to
retire its local bridge, which is not flex-auth's to close.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

examples/tenant-engine/README.md

@@ -74,6 +74,12 @@ covered by fixture and by
 driven through the client, which only ever emits the seven registered strings
 — which is the property the guard exists to protect.
 
+**Not yet in production.** The policy package is baked into the container
+image, so the deployed `flex-auth-tenant-engine` Deployment still serves the
+pre-FLEX-WP-0010 four-action policy — probed 2026-08-10, `tenant.retire`
+returns deny `unknown_action` there. A new image built from this commit and
+rolled out is the remaining step before a live lifecycle mutation succeeds.
+
 ## Related
 
 - `docs/tenant-engine-resource-namespace.md`