Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

docs/flex-auth-caller-identity.md

@@ -2,6 +2,14 @@
 
 Status: caller side implemented and deployed; live proof pending flex-auth A2 promotion (FLEX-WP-0015-T02).
 
+Governing published policy (2026-08-19):
+
+- IAM Profile v0.3 Service Account Flow — audience-scoped, rotating
+  workload identity:
+  `https://policy.coulomb.social/standards/iam-profile/v0.3/`
+- Tenancy Posture v0.1 A2 — inbound caller choke point:
+  `https://policy.coulomb.social/standards/tenancy-posture/v0.1/`
+
 user-engine calls `flex-auth-user-engine` with a projected Kubernetes
 ServiceAccount token whose audience is exactly `flex-auth`. The adapter reads
 the token file for every decision so hourly projection rotation requires no
@@ -77,7 +85,9 @@ BODY='{"actor":{"issuer":"https://kc.coulomb.social","subject":"probe",
 3. **user-engine cannot represent another protected system.** Re-run step 1
    with `resource.system` set to `tenant-engine`. Expect a refusal from the
    binding, not an allow: the token binds `user-engine` to
-   `system:serviceaccount:user-engine:user-engine` only.
+   `system:serviceaccount:user-engine:user-engine` only. That binding is the
+   A2 choke point named by Tenancy Posture v0.1; publication does not change
+   the remaining operator sequence.
 
 Record all three results, the flex-auth digest they ran against, and the
 user-engine digest, in USER-WP-0023-T03 before marking it done. A pass on