workplan: RAIL-EN-WP-0001 private-by-default templates

Intake from RMASTER-WP-0023. Adopt RAIL-EN-WP- so ids do not collide
with other RAILIANCE-WP- repos.

workplans/RAIL-EN-WP-0001-private-by-default-templates.md

@@ -0,0 +1,40 @@
+---
+id: RAIL-EN-WP-0001
+type: workplan
+title: "Templates emit private Services, never a public Ingress by default"
+domain: financials
+repo: railiance-enablement
+status: ready
+owner: codex
+topic_slug: railiance
+created: "2026-08-15"
+updated: "2026-08-15"
+related:
+  - RMASTER-WP-0023
+  - ADR-0008
+---
+
+# RAIL-EN-WP-0001 — private-by-default templates
+
+Intake from `RMASTER-WP-0023-T05`.
+
+## Goal
+
+New-rapp and new-rail templates emit private Services and tunnel docs.
+They never emit a public Ingress by default. If a template mentions
+`exposure`, default to `private` or omit the field (fail-closed).
+
+## T01 — Audit and fix templates
+
+```task
+id: RAIL-EN-WP-0001-T01
+status: todo
+priority: high
+```
+
+Find every template that creates a Service or Ingress. Make ClusterIP
+the default. Replace public Ingress examples with a grant-gated snippet
+that cites ADR-0008.
+
+**Done when:** a new package from the paved path is private unless the
+author adds an explicit grant.