feat: implement RMASTER-WP-0023 private-by-default exposure

Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.

docs/exposure-enforcement-intakes.md

@@ -0,0 +1,73 @@
+# Exposure enforcement intakes
+
+Date: 2026-08-15
+Source: `RMASTER-WP-0023-T05`
+Back-link: `RMASTER-WP-0023`
+
+These are intakes for the owning-repo agents. File a workplan in the
+owning repo. Do not implement the controls from `railiance-master`.
+
+Normative reading:
+
+- [`docs/adr/ADR-0008-private-by-default-exposure.md`](adr/ADR-0008-private-by-default-exposure.md)
+- [`docs/exposure-posture-contract.md`](exposure-posture-contract.md)
+- Snapshot of already-public surfaces:
+  [`docs/evidence/reef-railiance-exposure-snapshot-2026-08-15.md`](evidence/reef-railiance-exposure-snapshot-2026-08-15.md)
+
+## Intake: `rail-kubernetes` (cc `railiance-cluster` until the rail owns networking)
+
+Enforce the packet path for rapps on Kubernetes:
+
+- default-deny NetworkPolicy
+- ClusterIP as the paved Service
+- no public Ingress class unless the rapp has `exposure.posture: public`
+  and a grant, the binding is `production-approved`, and the reef has
+  granted a public surface
+- a rail `exposure: public` is permission to *emit* Ingress for those
+  granted bindings, not a blanket public default
+
+Do not define what "production-safe" means. That stays ADR-0006.
+
+Suggested workplan id in the owning repo: a `RAIL-K8S-WP-*` or
+`RAILIANCE-WP-*` that cites `RMASTER-WP-0023`.
+
+## Intake: `reef-railiance`
+
+First live admission of the family rule:
+
+- new binds stay `private` (or `operator` only for a named admin path)
+- add `exposure` to `declarations/reef.yaml` with substrate grants for
+  the snapshot rows that belong on the reef (`80/443` DNS/Ingress
+  surface, Nydus `2224`)
+- do not take down Forgejo, Coulomb Social, reuse-surface, or Nydus
+- do not re-public `6443`
+
+Suggested workplan id: a `REEF-RAILIANCE-WP-*` that cites
+`RMASTER-WP-0023`.
+
+## Intake: `railiance-infra`
+
+Host surface for **new** reefs:
+
+- do not open 80/443 until the reef declaration carries a public
+  substrate grant
+- `6443` stays operator-only (RAIL-HO-WP-0009 / ADR-005). This contract
+  is not a way to reopen it
+- this is not the rapp admission desk. A rapp that shares Railiance01
+  ingress is gated by the rail/reef grants, not by a new S1 UFW rule
+  per rapp
+- Nydus `2224` stays a named exception, already declared
+
+Suggested workplan id: a `RAIL-HO-WP-*` that cites `RMASTER-WP-0023`.
+
+## Intake: `railiance-enablement`
+
+Templates and paved paths:
+
+- emit private Services and tunnel docs by default
+- never emit a public Ingress in a new-rapp or new-rail template
+- if a template mentions `exposure`, default the field to `private` or
+  omit it (fail-closed)
+
+Suggested workplan id: an enablement workplan that cites
+`RMASTER-WP-0023`.