NK-WP-0026 finished: user-engine caller identity verified live against railiance01

T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth
token per decision (verified in the running container); flex-auth-user-engine
138aa347 serves with caller-auth enforce. Probes: valid 200
decision:d9aef25f08e17b84, missing token 401, wrong-system 403.

Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned
against, while the cluster ran c501aeb2. Re-applying it would have rolled the
portal back to an image that cannot authenticate to a PDP now in enforce.
kubectl diff is now empty.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sso-mfa/k8s/user-engine/runtime.yaml

@@ -40,12 +40,13 @@ spec:
       labels: *labels
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: user-engine
       securityContext:
         runAsNonRoot: true
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: portal
-          image: forgejo.coulomb.social/coulomb/user-engine@sha256:e3b5f65bafc1c0260dfdf2567a52766e67506ceb878a51759a2e9a307c4b5eb8
+          image: forgejo.coulomb.social/coulomb/user-engine@sha256:c501aeb204154d85017565a87fd34cff12e5c48f600d124d3f8c82f11bb9d59c
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
@@ -62,6 +63,7 @@ spec:
             - {name: USER_ENGINE_OIDC_REDIRECT_URI, value: "https://users.92-205-62-239.nip.io/oidc/callback"}
             - {name: USER_ENGINE_OIDC_BACKEND_URL, value: "http://keycape.sso.svc.cluster.local:8080"}
             - {name: USER_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080"}
+            - {name: USER_ENGINE_FLEX_AUTH_TOKEN_FILE, value: "/var/run/secrets/flex-auth-caller/token"}
             - {name: USER_ENGINE_EVENT_URL, value: "http://audit-core.audit-core.svc.cluster.local:8080/v1/events"}
             - {name: USER_ENGINE_MAIL_URL, value: "http://email-connect.email-connect.svc.cluster.local:8080/v1/send"}
             - name: USER_ENGINE_EVENT_TOKEN
@@ -90,6 +92,10 @@ spec:
             allowPrivilegeEscalation: false
             capabilities: {drop: ["ALL"]}
             readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: flex-auth-caller
+              mountPath: /var/run/secrets/flex-auth-caller
+              readOnly: true
           resources:
             requests: {cpu: 50m, memory: 64Mi}
             limits: {cpu: 500m, memory: 256Mi}
@@ -103,6 +109,15 @@ spec:
           livenessProbe:
             httpGet: {path: /healthz, port: http}
             periodSeconds: 20
+      volumes:
+        - name: flex-auth-caller
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  audience: flex-auth
+                  expirationSeconds: 3600
+                  path: token
 ---
 apiVersion: v1
 kind: Service
@@ -111,6 +126,11 @@ spec:
   selector: {app.kubernetes.io/name: user-engine}
   ports: [{name: http, port: 8080, targetPort: http}]
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata: {name: user-engine, namespace: user-engine}
+automountServiceAccountToken: false
+---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata: {name: user-engine-default-deny, namespace: user-engine}