Send a caller identity to flex-auth so policy.enabled can flip

flex-auth's flex-auth-ops-warden pin (FLEX-WP-0016) TokenReviews the caller and
binds resource.system: ops-warden to system:serviceaccount:ops-warden:ops-warden.
policy.py posted /v1/check with no Authorization header, so the pin logs
"caller authentication warning" and can only run callerAuth.mode: warn — which,
under ADHOC-2026-08-17-T01, is exactly what blocks policy.enabled: true.

- policy.caller_auth (none | file | env | command) + src/warden/caller_identity.py:
  token resolved per call, never cached, written, or logged (ADR-0002)
- both check_sign_policy and check_fetch_policy attach the bearer header; an
  unobtainable token fails closed rather than retrying anonymously
- scripts/check_policy_caller_identity.py: read-only gate, prints length and a
  truncated fingerprint only, distinguishes 401 (audience/binding) from 403
- example config: caller_auth block, and flex_auth_url corrected — it pointed at
  flex-auth.flex-auth.svc, a Service that does not exist
- WARDEN-WP-0031, PolicyGatedSigning caller-identity section and flip sequence

Default stays mode: none, so behaviour is unchanged until an operator opts in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

examples/warden.production.example.yaml

@@ -19,9 +19,29 @@ state_dir: ~/.local/state/warden
 # Registry: registry/flex-auth/production_registry_snapshot.json (build from inventory).
 # See wiki/PolicyGatedSigning.md (operator checklist) and wiki/playbooks/operator-openbao-token-hygiene.md
 policy:
+  # Keep false until the flex-auth ops-warden pin runs callerAuth.mode: enforce.
+  # Gate: python scripts/check_policy_caller_identity.py  (WARDEN-WP-0031)
   enabled: false
-  flex_auth_url: http://flex-auth.flex-auth.svc.cluster.local:8080
+  # The in-cluster pin for ops-warden's signing policy (FLEX-WP-0016). A bare
+  # flex-auth.flex-auth.svc Service does not exist. From a workstation, reach it
+  # through a port-forward or tunnel and point this at that local address.
+  flex_auth_url: http://flex-auth-ops-warden.flex-auth.svc.cluster.local:8080
   fail_closed: true
   tenant: tenant:platform
   subject_env: WARDEN_POLICY_SUBJECT
-  system: ops-warden
+  system: ops-warden
+  # How ops-warden proves it is ops-warden. flex-auth TokenReviews this bearer
+  # token and requires the principal system:serviceaccount:ops-warden:ops-warden
+  # for resource.system: ops-warden. Mode none sends no header, which is what
+  # holds the pin in warn.
+  caller_auth:
+    mode: none  # none | file | env | command
+    # In-cluster PEP — projected ServiceAccount token, audience-bound:
+    # mode: file
+    # token_path: /var/run/secrets/flex-auth/token
+    # Workstation — mint a short-lived bound token per call:
+    # mode: command
+    # command: kubectl create token ops-warden -n ops-warden
+    #   --audience flex-auth --duration 10m
+    token_env: WARDEN_POLICY_CALLER_TOKEN
+    audience: flex-auth