Send a caller identity to flex-auth so policy.enabled can flip

flex-auth's flex-auth-ops-warden pin (FLEX-WP-0016) TokenReviews the caller and
binds resource.system: ops-warden to system:serviceaccount:ops-warden:ops-warden.
policy.py posted /v1/check with no Authorization header, so the pin logs
"caller authentication warning" and can only run callerAuth.mode: warn — which,
under ADHOC-2026-08-17-T01, is exactly what blocks policy.enabled: true.

- policy.caller_auth (none | file | env | command) + src/warden/caller_identity.py:
  token resolved per call, never cached, written, or logged (ADR-0002)
- both check_sign_policy and check_fetch_policy attach the bearer header; an
  unobtainable token fails closed rather than retrying anonymously
- scripts/check_policy_caller_identity.py: read-only gate, prints length and a
  truncated fingerprint only, distinguishes 401 (audience/binding) from 403
- example config: caller_auth block, and flex_auth_url corrected — it pointed at
  flex-auth.flex-auth.svc, a Service that does not exist
- WARDEN-WP-0031, PolicyGatedSigning caller-identity section and flip sequence

Default stays mode: none, so behaviour is unchanged until an operator opts in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

SCOPE.md

@@ -50,8 +50,12 @@ net-kingdom / info-tech-canon is owner-driven (tracked via coordination messages
 
 **Policy gate** is shipped on the caller side (WP-0007) with production registry
 and smoke evidence (WP-0009 archived). flex-auth published the `ssh-certificate`
-policy package (FLEX-WP-0006). `policy.enabled` remains **false** in production
-until flex-auth is deployed to a reachable URL (flex-auth FLEX-WP-0007).
+policy package (FLEX-WP-0006) and now runs the in-cluster pin
+`flex-auth-ops-warden` (FLEX-WP-0007 finished; FLEX-WP-0016). `policy.enabled`
+remains **false**: that pin is in `callerAuth.mode: warn` because ops-warden sent
+no caller identity. WP-0031 ships the calling side (`policy.caller_auth` +
+`scripts/check_policy_caller_identity.py`); the flip waits on an operator picking
+a token source and flex-auth then enforcing.
 
 **ops-bridge cert_command pilot** is shipped to pilot-ready (WP-0016): a read-only
 readiness gate (`scripts/check_tunnel_cert_readiness.py`) plus an opt-in offline
@@ -273,6 +277,7 @@ for the rest.
 | WP | Status | Focus |
 | --- | --- | --- |
 | WP-0027 | `backlog` | Tamper-resistant credential governance + mass rotation/lockdown (Strand B follow-on to WP-0026) |
+| WP-0031 | `active` | Calling-side identity for flex-auth — code + gate done; flip sequence waits on operator + flex-auth enforce |
 | WP-0030 | `proposed` | Delegation register — record intended owner + blocker on every interim lane, `warden route gaps`, promotion gate |
 
 Remaining production distance is also in other repos' lanes (see Known gaps).
@@ -281,7 +286,7 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
 
 | Gap | Owner | Notes |
 | --- | --- | --- |
-| flex-auth production runtime + registry deploy | flex-auth | **FLEX-WP-0007** — unblocks `policy.enabled: true` |
+| `callerAuth.mode: enforce` on the ops-warden pin | flex-auth | **FLEX-WP-0016 T03** — waits on WARDEN-WP-0031 T04, then unblocks `policy.enabled: true` |
 | ops-bridge `cert_command` on live tunnels | ops-bridge | Playbook + readiness gate shipped (WP-0016); pilot cutover handed off, awaiting ops-bridge |
 | Principals sync warden ↔ railiance-infra | ops-warden + infra | `scripts/check_principals_drift.py` — operator runs periodically |
 | NK-WP-0009 joint SSH tutorial | net-kingdom | Parallel coordination track |
@@ -347,7 +352,8 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
 - **Production sign:** verified 2026-06-18 (`history/2026-06-17-openbao-production-verify.md`)
 - **Access routing:** WP-0010 + WP-0011 shipped (`warden route`, pointer catalog)
 - **Policy gate:** caller shipped (WP-0007); registry + smoke complete (WP-0009 archived).
-  `policy.enabled: false` until flex-auth reachable (`FLEX-WP-0007`)
+  `policy.enabled: false` — the `flex-auth-ops-warden` pin is in `warn` until
+  ops-warden sends a caller identity (WP-0031)
 - **Workload posture:** WP-0015 shipped (standard, descriptors, `warden policy`,
   conformance checker, dev doubles); canon landing owner-driven
 - **ops-bridge cert_command:** WP-0016 shipped to pilot-ready (readiness gate +