Enforce caller-auth on flex-auth-user-engine and record the live A2 probe

Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347
warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens
must use the API default audiences or TokenReview 401s on this k3s.
Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine
is unchanged. tenancy.current.A stays 0 until that pin moves.

tenancy.yaml

@@ -39,12 +39,12 @@ tenancy:
       decision point judges asserted claims, it cannot be the verifier of its
       own inputs. Not a defect and not a target for movement.
     A: >-
-      The running immutable digest still authenticates no caller, so current
-      remains A0. Source, overlay, and reviewed desired manifests implement
-      A2 with an audience-scoped Kubernetes TokenReview choke point and exact
-      protected-system-to-ServiceAccount bindings. The first production pin
-      is warn, independently per consumer, under FLEX-WP-0011/FLEX-WP-0015-T02.
-      Current moves to A2 only after enforce and a live unbound-request probe.
+      flex-auth-user-engine is live A2 as of 2026-08-19: digest
+      sha256:138aa347…, callerAuth.mode=enforce, unbound request returns
+      401 and a cross-system token is 403. flex-auth-tenant-engine still
+      runs sha256:1bf060e6… with no caller authentication, so the service
+      declaration stays current A0 until that pin is warn-then-enforce.
+      Source and overlay implement A2 on both consumers.
     E: >-
       No tenant data at rest. Tenant scoping in decisions runs through one
       choke point (internal/decision/engine.go normalizeRequest and the