feat: implement RMASTER-WP-0023 private-by-default exposure

Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.

tools/testdata/family-declarations/good-exposure/inventory.json

@@ -0,0 +1,8 @@
+{
+  "source": "fixture",
+  "captured_at": "2026-08-15T00:00:00Z",
+  "reef": "reef-example",
+  "deployables": [
+    {"name": "example", "namespace": "example", "kind": "helm-release"}
+  ]
+}