Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

deploy/README.md

@@ -7,6 +7,12 @@ emergency kubectl path recovered on 2026-08-11 from live
 `last-applied-configuration`, kept so a rollback does not depend on a
 cluster annotation or on Helm history.
 
+Caller authentication (FLEX-WP-0015-T02) is pinned here in **`warn`**,
+matching `values/user-engine.yaml` and `values/tenant-engine.yaml`. Do not
+edit these files back to `enforce` and apply them as a shortcut: that is
+the hazard. Flip `callerAuth.mode` per consumer in the overlay after that
+consumer's warn logs are clean, then re-render or edit only that pin.
+
 Manifests for the two cluster-local flex-auth policy-decision services.
 
 | File | Deployment | Consumer | Service DNS |
@@ -86,10 +92,12 @@ last-known-good digest below.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | **live** — nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
+| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth **warn** (FLEX-WP-0015-T02), CI `main-3de72fe` |
+| `flex-auth-tenant-engine` *(live until warn promote)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
 | `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore; guardrail actions deny `unknown_action` |
 | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
-| `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
+| `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth **warn** (FLEX-WP-0015-T02), CI `main-3de72fe` |
+| `flex-auth-user-engine` *(live until warn promote)* | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |
 
 Rolling back the tenant-engine service to `c25fc34a…` restores fail-closed

deploy/flex-auth-tenant-engine.yaml

@@ -25,12 +25,12 @@ spec:
         - --policy
         - /opt/flex-auth/examples/tenant-engine/policy_package.md
         - --caller-auth-mode
-        - enforce
+        - warn
         - --caller-kubernetes-url
         - https://10.43.0.1
         - --caller-binding
         - tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
         livenessProbe:
           httpGet:
             path: /healthz

deploy/flex-auth-user-engine.yaml

@@ -25,12 +25,12 @@ spec:
         - --policy
         - /opt/flex-auth/examples/user-engine/policy_package.md
         - --caller-auth-mode
-        - enforce
+        - warn
         - --caller-kubernetes-url
         - https://10.43.0.1
         - --caller-binding
         - user-engine=system:serviceaccount:user-engine:user-engine
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
         livenessProbe:
           httpGet:
             path: /healthz