feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

wiki/NetKingdomSecurityMap.md

@@ -135,11 +135,12 @@ schedule rather than in lockstep. The binding condition is sequencing, not a dat
 flex-auth warn-only  ->  ops-warden pre-sign gate presents its SA token
                      ->  logs clean of unauthenticated callers
                      ->  flex-auth fail-closed
-                     ->  policy.enabled: true  (ops-warden side, FLEX-WP-0007)
+                     ->  zone-specific enforce stance (flex-auth policy package)
 ```
 
-`policy.enabled` must not flip anywhere while `/v1/check` still answers
-unauthenticated callers.
+An enforce stance must not be assigned while `/v1/check` still answers
+unauthenticated callers. ops-warden has no global enable switch or gate bypass;
+it applies the compiled zone stance and its local per-zone failure mode.
 
 **Division of the call:** the mechanism above is an architecture recommendation and
 ops-warden's to make. Accepting the pod-spec change and the rollout timing are the
@@ -179,4 +180,4 @@ and automation work — not platform-admin equivalents on hosts.
 - `wiki/AccessRouting.md` — issue-vs-route role and boundary
 - `wiki/CredentialRouting.md`
 - `wiki/PolicyGatedSigning.md` (future flex-auth hook)
-- `net-kingdom/docs/platform-identity-security-architecture.md`
+- `net-kingdom/docs/platform-identity-security-architecture.md`