Onboard tenant-engine to the staged-promotion contract

TEN-WP-0008. railiance/app.toml declares criticality=high, empty secrets,
isolated canary, and the live PostgreSQL digest as previous_stable.
Manifests render through kustomize (deploy/ and deploy/canary/). Stage 1
passed. Stage 2/3 Helm-only CLI gap requested as RAIL-BS-IN-0001 rather
than a dummy chart.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

deploy/canary/kustomization.yaml

@@ -0,0 +1,46 @@
+# Isolated Stage 2 canary. TEN-WP-0009 moved production off a ReadWriteOnce
+# PVC onto PostgreSQL with RollingUpdate, so a second pod is storage-feasible.
+# Isolation is a distinct Deployment + Service selector, not a second replica
+# behind the production Service — user-engine's NetworkPolicy still points at
+# app.kubernetes.io/name=tenant-engine and must not start sending traffic here.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - target:
+      kind: Deployment
+      name: tenant-engine
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: tenant-engine-canary
+      - op: replace
+        path: /spec/selector/matchLabels/app.kubernetes.io~1name
+        value: tenant-engine-canary
+      - op: replace
+        path: /spec/template/metadata/labels/app.kubernetes.io~1name
+        value: tenant-engine-canary
+  - target:
+      kind: Service
+      name: tenant-engine
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: tenant-engine-canary
+      - op: replace
+        path: /spec/selector/app.kubernetes.io~1name
+        value: tenant-engine-canary
+  - target:
+      kind: NetworkPolicy
+      name: tenant-engine
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: tenant-engine-canary
+      - op: replace
+        path: /spec/podSelector/matchLabels/app.kubernetes.io~1name
+        value: tenant-engine-canary
+      - op: replace
+        path: /spec/ingress
+        value: []