NK-WP-0039-T03: point repository coordinates at access-engine

Runtime and package names stay flex-auth (FLEX-DEC-2026-013).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

docs/tutorials/protected-system-flex-auth.md

@@ -19,7 +19,7 @@ back, and is refused when the caller is wrong.
 ## Prerequisites
 
 - **[owner: flex-auth]** A local checkout of `flex-auth` with Go, to run
-  `go run ./cmd/flex-auth`. Read `flex-auth/docs/decision-record-contract.md`.
+  `go run ./cmd/flex-auth`. Read `access-engine/docs/decision-record-contract.md`.
 - **[owner: your system's repo]** A system id and a list of the things it
   protects and the actions it performs on them.
 - **[owner: railiance-platform / package owner, ADR-0015]** A Kubernetes
@@ -67,7 +67,7 @@ consumer running with caller auth in `warn` mode is not protected.
    `Authorization: Bearer`. Use the in-cluster trailing-dot FQDN of the pin, never
    a bare service name.
 7. **[owner: flex-auth]** Set caller authentication to `enforce` and run the
-   four negative tests from `flex-auth/docs/operator-caller-access-path.md`
+   four negative tests from `access-engine/docs/operator-caller-access-path.md`
    (no header, wrong ServiceAccount, wrong audience, expired token).
 8. **[owner: your system's repo]** Enforce the envelope: `allow` proceeds;
    `deny` blocks; `redact` and `audit_only` apply their obligations; any