Finish RAILIANCE-WP-0021: family schemas, validator, and ADR-0007

Add rail and reef schemas, derive reef bound_rapps from rapp.bound_reefs,
and ship a standalone family-declaration validator with an inventory-fed
coverage check. Point the bootstrap contract at the schemas, record the
dimension and cardinality decisions in ADR-0007, correct the first-wave
candidates document, and release the shape to downstream repos.

tools/testdata/family-declarations/bad-stale-bound/inventory.json

@@ -0,0 +1,9 @@
+{
+  "source": "fixture",
+  "captured_at": "2026-08-13T00:00:00Z",
+  "reef": "reef-example",
+  "deployables": [
+    {"name": "example", "namespace": "example", "kind": "helm-release"},
+    {"name": "undeclared-live", "namespace": "other", "kind": "deployment"}
+  ]
+}

tools/testdata/family-declarations/bad-stale-bound/rail-kubernetes/declarations/rail.yaml

@@ -0,0 +1,12 @@
+kind: execution-rail
+rail_id: rail-kubernetes
+repo: rail-kubernetes
+ownership_repo: railiance-cluster
+contract_version: 1.0.0
+composition_kind: base
+execution_architecture: kubernetes
+readiness_state: verified
+required_substrate_capabilities:
+  - kubernetes-api
+supported_rollout_modes:
+  - stage1-run

tools/testdata/family-declarations/bad-stale-bound/rapp-example/declarations/rapp.yaml

@@ -0,0 +1,33 @@
+kind: managed-workload-package
+repo_family: rapp
+rapp_id: rapp-example
+repo: rapp-example
+ownership_repo: railiance-platform
+contract_version: 1.0.0
+readiness_state: declared
+workload_identity:
+  name: example
+  package_type: helm-managed-platform-service
+data_classification: internal
+criticality: medium
+primary_rail: rail-kubernetes
+supported_rails:
+  - rail-kubernetes
+bound_reefs: []
+runtime_dependencies:
+  - kubernetes-api
+composition:
+  purpose: Example rapp that does not name a reef.
+  member_repos:
+    - repo: rapp-example
+      role: package
+      deployables:
+        - example
+rollout_contract:
+  default_mode: helm-upgrade-install
+smoke_contract:
+  required:
+    - example-status-ok
+rollback_contract:
+  order:
+    - helm-rollback

tools/testdata/family-declarations/bad-stale-bound/rapp-orphan/README.md

@@ -0,0 +1 @@
+Undeclared family-prefix fixture for the validator. No declarations/.

tools/testdata/family-declarations/bad-stale-bound/reef-example/declarations/reef.yaml

@@ -0,0 +1,14 @@
+kind: substrate-reef
+reef_id: reef-example
+repo: reef-example
+ownership_repo: railiance-infra
+substrate_kind: server-group
+lifecycle_state: active
+criticality: high
+primary_rail: rail-kubernetes
+hosted_rails:
+  - rail-kubernetes
+bound_rapps:
+  - rapp-example
+current_members:
+  - Example01

tools/testdata/family-declarations/good/inventory.json

@@ -0,0 +1,8 @@
+{
+  "source": "fixture",
+  "captured_at": "2026-08-13T00:00:00Z",
+  "reef": "reef-example",
+  "deployables": [
+    {"name": "example", "namespace": "example", "kind": "helm-release"}
+  ]
+}

tools/testdata/family-declarations/good/rail-knative/declarations/rail.yaml

@@ -0,0 +1,21 @@
+kind: execution-rail
+rail_id: rail-knative
+repo: rail-knative
+ownership_repo: railiance-cluster
+contract_version: 1.0.0
+composition_kind: derived
+base_rail: rail-kubernetes
+base_rail_contract: 1.0.0
+execution_architecture: knative-serving-on-kubernetes
+readiness_state: verified
+required_substrate_capabilities:
+  - kubernetes-api
+  - knative-serving
+supported_rollout_modes:
+  - revision-canary
+inherited_semantics:
+  - workload-identity
+overridden_semantics:
+  - request-activation
+compatibility_constraints:
+  - rail-kubernetes contract must equal 1.0.0

tools/testdata/family-declarations/good/rail-kubernetes/declarations/rail.yaml

@@ -0,0 +1,12 @@
+kind: execution-rail
+rail_id: rail-kubernetes
+repo: rail-kubernetes
+ownership_repo: railiance-cluster
+contract_version: 1.0.0
+composition_kind: base
+execution_architecture: kubernetes
+readiness_state: verified
+required_substrate_capabilities:
+  - kubernetes-api
+supported_rollout_modes:
+  - stage1-run

tools/testdata/family-declarations/good/rapp-example/declarations/rapp.yaml

@@ -0,0 +1,34 @@
+kind: managed-workload-package
+repo_family: rapp
+rapp_id: rapp-example
+repo: rapp-example
+ownership_repo: railiance-platform
+contract_version: 1.0.0
+readiness_state: declared
+workload_identity:
+  name: example
+  package_type: helm-managed-platform-service
+data_classification: internal
+criticality: medium
+primary_rail: rail-kubernetes
+supported_rails:
+  - rail-kubernetes
+bound_reefs:
+  - reef-example
+runtime_dependencies:
+  - kubernetes-api
+composition:
+  purpose: Example single-repo rapp used as a validator fixture.
+  member_repos:
+    - repo: rapp-example
+      role: package
+      deployables:
+        - example
+rollout_contract:
+  default_mode: helm-upgrade-install
+smoke_contract:
+  required:
+    - example-status-ok
+rollback_contract:
+  order:
+    - helm-rollback

tools/testdata/family-declarations/good/reef-example/declarations/reef.yaml

@@ -0,0 +1,15 @@
+kind: substrate-reef
+reef_id: reef-example
+repo: reef-example
+ownership_repo: railiance-infra
+substrate_kind: server-group
+lifecycle_state: active
+criticality: high
+primary_rail: rail-kubernetes
+hosted_rails:
+  - rail-kubernetes
+  - rail-knative
+bound_rapps:
+  - rapp-example
+current_members:
+  - Example01