Retire CoulombCore references; correct the 16443 diagnosis

CoulombCore is being retired, so the docs stop using it as the reference host:
state-hub-coulombcore examples become state-hub-railiance01, and the reuse-surface
playbook no longer attributes bao.coulomb.social to it — that resolves to
92.205.62.239, which is railiance01. The openrouter lane keeps its factual note
about ESO on the CoulombCore cluster, with a retirement flag for its owner.

Also corrects this session's own error. The WP-0031 evidence blamed the
Unauthorized on a local-port collision between k3s-api-coulombcore and
k3s-api-haskelseed. That was wrong: the haskelseed tunnel is a reverse forward,
where local_port is a destination rather than a listener, so they never competed.
16443 was simply CoulombCore's k3s — a different cluster whose client CA does not
know that cert. The wrong reason had already gone to flex-auth, so it is
corrected in the file rather than quietly dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/WARDEN-WP-0031-policy-caller-identity.md

@@ -127,8 +127,9 @@ that line, not the allow, is the evidence.
 
 Done 2026-08-19. Source is `mode: command` — `kubectl create token ops-warden
 -n ops-warden --audience flex-auth --duration 10m` against the railiance01
-cluster (tunnel `k3s-api-railiance01`, local `16444`; note `16443` is claimed by
-two tunnels at once, which is why a `system:masters` cert 401s there).
+cluster (tunnel `k3s-api-railiance01`, local `16444`; `16443` was CoulombCore's
+k3s, a different cluster, which is why a `system:masters` cert 401s there —
+not a port collision, as first reported).
 `deploy/kubernetes/caller-identity.yaml` creates the Namespace and
 ServiceAccount the binding names — no RBAC, `automountServiceAccountToken:
 false`; it exists only to be TokenReviewed. Gate exits 0 live: