Close USER-WP-0023 after live A2 enforce evidence

flex-auth-user-engine is enforce on sha256:138aa347. Probe from
user-engine-8569d7cb87-fp7px: 200 with the projected token, 401 without,
403 when representing tenant-engine. Record fsGroup 10001 so uid 10001
can read the projected caller token.

workplans/USER-WP-0023-flex-auth-caller-identity.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Bind user-engine to flex-auth with rotating workload identity"
 domain: communication
 repo: user-engine
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-18"
@@ -49,7 +49,7 @@ adapter request coverage.
 
 ```task
 id: USER-WP-0023-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "0499c65b-491d-4ed1-8549-f58dba48f612"
 ```
@@ -99,7 +99,19 @@ same split this workplan already implemented.
   (`https://policy.coulomb.social/architecture/net-kingdom/v0.1/`) lists
   both documents in chapter 9.
 
-The workplan stays `active` because T03's live proof is still owed. That
-proof is not unblocked by publication.
+2026-08-19 close: flex-auth-user-engine is live `enforce` (Helm release
+rev 4, digest `sha256:138aa347…`). Probe from pod
+`user-engine-8569d7cb87-fp7px` (message `45852487`, FLEX-WP-0015-T02):
+
+1. Bearer projected token → `200` `decision:350b46fb42989606` allow
+   `tenant_admin`
+2. No Authorization → `401` `unauthenticated` (not a decision)
+3. `resource.system=tenant-engine` → `403` `forbidden` (binding, not allow)
+
+user-engine digest `sha256:c501aeb2…`. tenant-engine and `policy.enabled`
+were not moved. Live user-engine needed `fsGroup: 10001` so uid 10001 can
+read the `0440 root:root` projected token; that is persisted in
+rapp-user-engine `manifests/runtime.yaml` `e599b4f`. This workplan is
+finished.
 
 Contract: `docs/flex-auth-caller-identity.md`.