Start TEN-WP-0005-T05: recover deploy manifests and add CI image build

Production still serves the TEN-WP-0004 image, which has no lifecycle
routes. Recover the live railiance01 objects into deploy/ so rollback
does not depend on a cluster annotation, and add the fleet CI image
workflow so the lifecycle image is built from a forge revision.

workplans/TEN-WP-0005-tenant-update-and-retirement-api.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: tenant-lifecycle
 created: "2026-08-10"
-updated: "2026-08-10"
+updated: "2026-08-14"
 depends_on:
   - TEN-WP-0004
 unblocks:
@@ -154,7 +154,7 @@ Not covered: no PostgreSQL tests exist, per the T02 note above.
 
 ```task
 id: TEN-WP-0005-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "9b21782a-1b26-4fac-81a1-06bd7e8cf70f"
 ```
@@ -177,3 +177,10 @@ correctly resolves to deny), and image build plus rollout need cluster access.
 The consumer-facing contract is finalized and ready to hand over:
 `docs/tenant-lifecycle-api.md`.
 
+Status 2026-08-14: flex-auth reports the seven-action policy live on
+`flex-auth-tenant-engine` (`@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7`,
+commit `e9911eb`). Production tenant-engine still runs the TEN-WP-0004 image
+(`@sha256:2249e8c6…85149207`); its OpenAPI has no lifecycle routes. Recovered
+the live manifests into `deploy/` and added the fleet CI image workflow so the
+lifecycle image is built from a forge revision rather than a workstation.
+