WARDEN-WP-0031 T04: prove ops-warden's caller identity against the live pin

flex-auth's binding names system:serviceaccount:ops-warden:ops-warden, and that
ServiceAccount did not exist. deploy/kubernetes/caller-identity.yaml creates it
plus its namespace — no RBAC, automount off; it is never used to call the
Kubernetes API, only to be TokenReviewed. Applied to the railiance01 cluster.

Operator warden.yaml now uses caller_auth mode: command (kubectl create token,
audience flex-auth, 10m). Gate exits 0 live against a port-forward of the pin:
HTTP 200, effect=allow, decision:f3f7c88f9585582a.

The evidence is not that allow — warn allows anonymous callers too. It is that
the pin's "caller authentication warning" count held at 4 across two
authenticated runs. That is the ADHOC-2026-08-17-T01 condition.

Also gives the readiness probe a structurally complete context, so a deny means
the policy said no rather than the probe being malformed.

policy.enabled stays false. T05 waits on flex-auth setting callerAuth.mode:
enforce (their FLEX-WP-0016 T03).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/kubernetes/caller-identity.yaml

@@ -0,0 +1,39 @@
+# ops-warden's calling identity for flex-auth (WARDEN-WP-0031 T04).
+#
+# flex-auth's `flex-auth-ops-warden` pin binds `resource.system: ops-warden` to
+# the principal `system:serviceaccount:ops-warden:ops-warden` and TokenReviews
+# the caller's bearer token with audience `flex-auth` (FLEX-WP-0016).
+#
+# This ServiceAccount is the subject of that binding. It holds no RBAC at all —
+# it is never used to talk to the Kubernetes API, only to be *reviewed* by it.
+# A workstation `warden sign` mints a short-lived bound token against it:
+#
+#   kubectl create token ops-warden -n ops-warden \
+#     --audience flex-auth --duration 10m
+#
+# Boundary note: cluster resources are railiance-platform's to own. This
+# manifest lives here because the identity is ops-warden's and flex-auth's
+# binding names it; railiance-platform should adopt it into the cluster's own
+# manifests, at which point this file becomes the record of what was applied
+# rather than the source of truth (ADR-0003 — cover the gap, name the owner).
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ops-warden
+  labels:
+    app.kubernetes.io/managed-by: ops-warden
+    netkingdom.coulomb.social/purpose: caller-identity
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ops-warden
+  namespace: ops-warden
+  labels:
+    app.kubernetes.io/managed-by: ops-warden
+  annotations:
+    netkingdom.coulomb.social/bound-by: >-
+      flex-auth-ops-warden callerAuth binding
+      ops-warden=system:serviceaccount:ops-warden:ops-warden (FLEX-WP-0016)
+    netkingdom.coulomb.social/workplan: WARDEN-WP-0031
+automountServiceAccountToken: false