CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing actions still allow; guardrail.read/set match the FLEX-WP-0014 split. user-engine pin unchanged. Rollback target is sha256:9320df39.
FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
