Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

docs/conformance-loop.md

@@ -0,0 +1,61 @@
+# Declared-vs-live conformance loop
+
+This is the S1 slice of the unowned **Q7 Governance and Change Management**
+gap recorded in `railiance-platform/ArchitectureBlueprint.md` §5.3. The
+family owner of the loop is **`railiance-master`**. This repo owns the host
+check and the first reaction path; it does not own rapp/rail/reef schema
+conformance (that is 10c, blocked on the family declaration validator).
+
+## What runs
+
+| Piece | Where | Cadence |
+| --- | --- | --- |
+| Rendered Goss baseline | `/etc/goss/baseline.yaml` from `goss/baseline.yaml.j2` | every `make verify` |
+| On-host timer | `railiance-goss-baseline.timer` | hourly, plus 5 minutes after boot |
+| Wrapper | `/usr/local/sbin/goss-baseline-check` | writes `/var/lib/railiance/goss/` |
+| Operator collect | `make goss-status` | on demand |
+| Operator run | `make verify` / `make verify-host HOST=…` | on demand; commits TAP to `reports/` |
+
+The firewall assertions are generated from the same inventory lists that
+converge UFW (`k3s_api_allowed_sources`, `k3s_api_revoked_sources`,
+`flannel_vxlan_allowed_sources`, `ufw_extra_allowed`). They assert:
+
+- each declared source is present
+- the **count** of non-Anywhere 6443/8472 allows equals the declared length
+  (extra hand grants fail)
+- no `ALLOW Anywhere` on 6443 or 8472
+- every revoked 6443 source is gone
+
+That is the check that would have caught `89.244.90.248` appearing on
+Railiance01 after T01.
+
+## Where failures go
+
+1. **journald** — `logger -t railiance-goss`
+2. **on-host flag** — `/var/lib/railiance/goss/FAILED` and `last.status`
+3. **optional State Hub POST** — set `RAILIANCE_GOSS_NOTIFY_URL` on the host
+   to a State Hub `/progress/` endpoint. The wrapper notifies only on a
+   pass↔fail transition, so a known-fail host (CoulombCore, UFW inactive)
+   does not spam.
+4. **git TAP** — `make verify` still commits `reports/goss-<host>-<ts>.tap`
+
+`make goss-status` fails the play if any host still has the `FAILED` flag.
+
+## Routing to Q7
+
+`railiance-master` owns the conformance loop as a family capability
+(ArchitectureBlueprint §5.3; RAILIANCE-WP-0016 item 10b). This file is the
+handoff:
+
+- S1 check: **exists and is scheduled** in this repo
+- S1 reaction: journald + flag + optional progress event
+- Family reaction (page a human, open a task, block a rollout): **not here**
+
+Do not build a second alert path in `railiance-telemetry` for the same
+"check failed → someone sees it" plumbing. Item 9b should reuse this.
+
+## Known expected fail
+
+`CoulombCore` has UFW inactive. The baseline asserts `Status: active`. The
+timer will fail there until an explicit decision enables UFW or the host is
+removed from the verify inventory. That failure is evidence, not noise.