Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

docs/adr/0004-inbound-caller-authentication.md

@@ -38,9 +38,11 @@ cached across rotation.
 
 Three modes support promotion: `disabled`, `warn`, and `enforce`. Warn mode
 records the same authentication failures without logging credentials. It is a
-bounded migration aid, not a conformant steady state. The reviewed desired
-manifests select `enforce`; promotion still follows FLEX-WP-0011 and requires a
-new immutable image digest plus caller rollout evidence.
+bounded migration aid, not a conformant steady state. The first production pin
+is `warn` on each independently rollable Deployment; `enforce` is the end
+state and is flipped per consumer after that consumer's warn logs are clean.
+Promotion follows FLEX-WP-0011. The two production pins must not be flipped
+together: user-engine can enforce while tenant-engine stays in warn.
 
 ## Rejected alternatives
 

docs/tenancy-posture-review.md

@@ -271,7 +271,7 @@ volunteer.
 | Task | |
 |---|---|
 | T01 | Publish the posture vector and this review; reply to `rapp-postgres` |
-| T02 | **Close the A0**: TokenReview source/desired state done; immutable promotion pending |
+| T02 | **Close the A0**: TokenReview source + warn-first overlay pin done; operator promote-then-per-consumer-enforce pending |
 | T03 | Deleted the unused tenant-engine live-roles adapter |
 | T04 | AuthZEN endpoint — `wait`, with a written trigger |
 | T05 | `make verify-posture` guards declaration/source/deployment drift |