Enforce caller-auth on flex-auth-user-engine and record the live A2 probe

Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347
warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens
must use the API default audiences or TokenReview 401s on this k3s.
Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine
is unchanged. tenancy.current.A stays 0 until that pin moves.

deploy/flex-auth-user-engine.yaml

@@ -25,7 +25,7 @@ spec:
         - --policy
         - /opt/flex-auth/examples/user-engine/policy_package.md
         - --caller-auth-mode
-        - warn
+        - enforce
         - --caller-kubernetes-url
         - https://10.43.0.1
         - --caller-binding
@@ -63,7 +63,10 @@ spec:
           name: flex-auth-reviewer
           readOnly: true
       securityContext:
+        fsGroup: 65532
+        runAsGroup: 65532
         runAsNonRoot: true
+        runAsUser: 65532
         seccompProfile:
           type: RuntimeDefault
       volumes:
@@ -72,7 +75,6 @@ spec:
           defaultMode: 0440
           sources:
           - serviceAccountToken:
-              audience: https://kubernetes.default.svc
               expirationSeconds: 3600
               path: token
           - configMap: