Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

deploy/flex-auth-user-engine.yaml

@@ -25,12 +25,12 @@ spec:
         - --policy
         - /opt/flex-auth/examples/user-engine/policy_package.md
         - --caller-auth-mode
-        - enforce
+        - warn
         - --caller-kubernetes-url
         - https://10.43.0.1
         - --caller-binding
         - user-engine=system:serviceaccount:user-engine:user-engine
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
         livenessProbe:
           httpGet:
             path: /healthz