feat: implement RMASTER-WP-0023 private-by-default exposure

Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.

tools/testdata/family-declarations/good-exposure/reef-example/declarations/reef.yaml

@@ -0,0 +1,21 @@
+kind: substrate-reef
+reef_id: reef-example
+repo: reef-example
+ownership_repo: railiance-infra
+substrate_kind: server-group
+lifecycle_state: active
+criticality: high
+primary_rail: rail-kubernetes
+hosted_rails:
+  - rail-kubernetes
+  - rail-knative
+current_members:
+  - Example01
+exposure:
+  posture: public
+  grants:
+    - hostname: example.coulomb.social
+      port: 443
+      reason: fixture public DNS surface
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-infra