Settles two questions raised by bringing NetKingdom under Railiance
governance:
1. Separate rapp-* repos per engine (rapp-tenant-engine, rapp-user-engine),
following repository-axes.md's one-workload rule. The decisive property is
independent rollback -- a single rapp would need one rollback contract
across independently versioned services. secrets-engine is not packaged as
a rapp: it has no deployed workload.
2. CloudNative PG via rapp-postgres is the default relational platform for
production. Per-workload SQLite-on-a-PVC is dev/test only, and
rail-kubernetes wave-1 does not support the persistent-storage contract it
depends on. tenant-engine migrates; its TenantStore Protocol makes this a
backend swap behind an existing seam.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
