Finish RAILIANCE-WP-0021: family schemas, validator, and ADR-0007

Add rail and reef schemas, derive reef bound_rapps from rapp.bound_reefs,
and ship a standalone family-declaration validator with an inventory-fed
coverage check. Point the bootstrap contract at the schemas, record the
dimension and cardinality decisions in ADR-0007, correct the first-wave
candidates document, and release the shape to downstream repos.

schemas/rapp.schema.json

@@ -18,6 +18,7 @@
     "criticality",
     "primary_rail",
     "supported_rails",
+    "bound_reefs",
     "runtime_dependencies",
     "composition",
     "rollout_contract",
@@ -73,6 +74,12 @@
       "uniqueItems": true,
       "items": { "$ref": "#/$defs/railSlug" }
     },
+    "bound_reefs": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/reefSlug" },
+      "description": "Reefs this package is bound to. Added by RAILIANCE-WP-0021-T04 as the source of reef.yaml bound_rapps. Required so the derivation is always defined: an empty list means the package is declared but not yet placed. The validator inverts this field to produce each reef's bound_rapps."
+    },
     "runtime_dependencies": {
       "type": "array",
       "minItems": 1,
@@ -128,6 +135,10 @@
       "type": "string",
       "pattern": "^rail-[a-z0-9]+(-[a-z0-9]+)*$"
     },
+    "reefSlug": {
+      "type": "string",
+      "pattern": "^reef-[a-z0-9]+(-[a-z0-9]+)*$"
+    },
     "semver": {
       "type": "string",
       "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"