Pin caller-auth digest in warn on independently rollable overlay pins

The sanctioned Helm chart could not promote ADR 0004 at all, and the
emergency manifests selected enforce. That made a FLEX-WP-0011 apply
either a no-op or a global 401. First production pin is now warn, per
consumer, on CI digest sha256:138aa347… . Enforce stays a later
per-consumer flip so USER-WP-0023-T03 can close without waiting on
tenant-engine.

tenancy.yaml

@@ -40,10 +40,11 @@ tenancy:
       own inputs. Not a defect and not a target for movement.
     A: >-
       The running immutable digest still authenticates no caller, so current
-      remains A0. Source and reviewed desired manifests implement A2 with an
-      audience-scoped Kubernetes TokenReview choke point and exact
-      protected-system-to-ServiceAccount bindings. Promotion and a live
-      unbound-request probe remain under FLEX-WP-0011/FLEX-WP-0015-T02.
+      remains A0. Source, overlay, and reviewed desired manifests implement
+      A2 with an audience-scoped Kubernetes TokenReview choke point and exact
+      protected-system-to-ServiceAccount bindings. The first production pin
+      is warn, independently per consumer, under FLEX-WP-0011/FLEX-WP-0015-T02.
+      Current moves to A2 only after enforce and a live unbound-request probe.
     E: >-
       No tenant data at rest. Tenant scoping in decisions runs through one
       choke point (internal/decision/engine.go normalizeRequest and the
@@ -84,6 +85,7 @@ evidence:
     - "internal/callerauth/auth.go"
     - "internal/callerauth/auth_test.go"
     - "cmd/flex-auth/main_test.go"
+    - "charts/flex-auth/templates/rbac.yaml"
     - "deploy/caller-auth-rbac.yaml"
     - "docs/adr/0004-inbound-caller-authentication.md"
-  deployment: "deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"
+  deployment: "values/user-engine.yaml, values/tenant-engine.yaml, deploy/flex-auth-user-engine.yaml, deploy/flex-auth-tenant-engine.yaml"