feat: implement RMASTER-WP-0023 private-by-default exposure

Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.

tools/testdata/family-declarations/good-exposure/rail-knative/declarations/rail.yaml

@@ -0,0 +1,21 @@
+kind: execution-rail
+rail_id: rail-knative
+repo: rail-knative
+ownership_repo: railiance-cluster
+contract_version: 1.0.0
+composition_kind: derived
+base_rail: rail-kubernetes
+base_rail_contract: 1.0.0
+execution_architecture: knative-serving-on-kubernetes
+readiness_state: verified
+required_substrate_capabilities:
+  - kubernetes-api
+  - knative-serving
+supported_rollout_modes:
+  - revision-canary
+inherited_semantics:
+  - workload-identity
+overridden_semantics:
+  - request-activation
+compatibility_constraints:
+  - rail-kubernetes contract must equal 1.0.0