TEN-IN-0005: declare audit-core egress, drain env and optional sender-token mount

Manifest half only; credential projection and rollout remain open.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 292700@bnt-lap001
Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341

deploy/base/tenant-engine.yaml

@@ -38,6 +38,13 @@ spec:
           value: http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080
         - name: TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE
           value: /var/run/secrets/flex-auth-caller/token
+        # TEN-IN-0005: outbox drain to audit-core. The token file is projected
+        # by the credential operator; until it exists the drain retries
+        # (token_unreadable) and mutations are unaffected.
+        - name: TENANT_ENGINE_AUDIT_CORE_URL
+          value: http://audit-core.audit-core.svc:8080
+        - name: TENANT_ENGINE_AUDIT_CORE_TOKEN_FILE
+          value: /var/run/secrets/audit-core-sender/token
         image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24
         livenessProbe:
           httpGet:
@@ -72,6 +79,9 @@ spec:
         - mountPath: /var/run/secrets/flex-auth-caller
           name: flex-auth-caller
           readOnly: true
+        - mountPath: /var/run/secrets/audit-core-sender
+          name: audit-core-sender
+          readOnly: true
       securityContext:
         fsGroup: 10001
         runAsNonRoot: true
@@ -85,6 +95,14 @@ spec:
           items:
           - key: url
             path: url
+      - name: audit-core-sender
+        secret:
+          defaultMode: 0440
+          optional: true
+          secretName: tenant-engine-audit-core-sender
+          items:
+          - key: token
+            path: token
       - name: flex-auth-caller
         projected:
           defaultMode: 0440
@@ -158,6 +176,16 @@ spec:
       podSelector:
         matchLabels:
           app.kubernetes.io/name: flex-auth-tenant-engine
+  - ports:
+    - port: 8080
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: audit-core
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: audit-core
   - ports:
     - port: 53
       protocol: UDP