Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

docs/interfaces/netkingdom-integration.md

@@ -13,6 +13,16 @@ See also the cross-repo assessment in the net-kingdom repo:
 `/home/worsch/net-kingdom/docs/user-engine-netkingdom-integration-assessment.md`
 (for current intent/scope fit, gaps, and recommendations as of 2026-06-03).
 
+Published governing contracts (policy-nexus, 2026-08-19):
+
+- IAM Profile v0.3: `https://policy.coulomb.social/standards/iam-profile/v0.3/`
+- Tenancy Posture v0.1: `https://policy.coulomb.social/standards/tenancy-posture/v0.1/`
+- NetKingdom architecture: `https://policy.coulomb.social/architecture/net-kingdom/v0.1/`
+
+The user-engine boundary contract remains accepted in net-kingdom
+(`canon/standards/user-engine-boundary-contract_v0.1.md`) and is marked
+`publish` in the policy-nexus ledger, but it is not yet on the site.
+
 ## Required Ports
 
 | Port | Direction | Purpose |
@@ -55,6 +65,7 @@ actor:
   tenant: string
   principal_type: human | service | agent
   roles: [string]
+  tenant_roles: [string]
   groups: [string]
   scopes: [string]
   assurance: object