Onboard tenant-engine to the staged-promotion contract

TEN-WP-0008. railiance/app.toml declares criticality=high, empty secrets,
isolated canary, and the live PostgreSQL digest as previous_stable.
Manifests render through kustomize (deploy/ and deploy/canary/). Stage 1
passed. Stage 2/3 Helm-only CLI gap requested as RAIL-BS-IN-0001 rather
than a dummy chart.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

deploy/base/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - tenant-engine.yaml

deploy/base/tenant-engine.yaml

@@ -0,0 +1,169 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tenant-engine
+  labels:
+    net-kingdom/component: tenant-engine
+    # TEN-WP-0009: rapp-postgres' consumer-ingress NetworkPolicy selects on
+    # this label, not on the declaration's spec.clientNamespaces -- that field
+    # is review metadata, this label is enforcement. Without it the pod cannot
+    # reach 5432 and the failure looks like DNS or a bad credential.
+    railiance.io/postgres-client: platform-pg
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tenant-engine
+  namespace: tenant-engine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tenant-engine
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tenant-engine
+    spec:
+      automountServiceAccountToken: false
+      serviceAccountName: tenant-engine
+      containers:
+      - name: tenant-engine
+        env:
+        - name: TENANT_ENGINE_DATABASE_URL_FILE
+          value: /var/run/secrets/postgres-runtime/url
+        - name: TENANT_ENGINE_FLEX_AUTH_URL
+          value: http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080
+        - name: TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE
+          value: /var/run/secrets/flex-auth-caller/token
+        image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24
+        livenessProbe:
+          httpGet:
+            path: /live
+            port: http
+          periodSeconds: 20
+        ports:
+        - containerPort: 8090
+          name: http
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: http
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 300m
+            memory: 192Mi
+          requests:
+            cpu: 25m
+            memory: 48Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/postgres-runtime
+          name: postgres-runtime
+          readOnly: true
+        - mountPath: /var/run/secrets/flex-auth-caller
+          name: flex-auth-caller
+          readOnly: true
+      securityContext:
+        fsGroup: 10001
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+      - name: postgres-runtime
+        secret:
+          defaultMode: 0440
+          secretName: tenant-engine-postgres-runtime
+          items:
+          - key: url
+            path: url
+      - name: flex-auth-caller
+        projected:
+          defaultMode: 0440
+          sources:
+          - serviceAccountToken:
+              audience: flex-auth
+              expirationSeconds: 3600
+              path: token
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tenant-engine
+  namespace: tenant-engine
+spec:
+  ports:
+  - name: http
+    port: 8090
+    targetPort: http
+  selector:
+    app.kubernetes.io/name: tenant-engine
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tenant-engine
+  namespace: tenant-engine
+automountServiceAccountToken: false
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tenant-engine
+  namespace: tenant-engine
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: tenant-engine
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: user-engine
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: user-engine
+    ports:
+    - port: 8090
+      protocol: TCP
+  egress:
+  - ports:
+    - port: 5432
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: platform-pg
+  - ports:
+    - port: 8080
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: flex-auth
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: flex-auth-tenant-engine
+  - ports:
+    - port: 53
+      protocol: UDP
+    - port: 53
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system