feat(RMASTER-WP-0026): declare Taxonomy layer and consume NetKingdom §20

Add layer.yaml, RMASTER-ADR-0009, the consumption contract, and a tracked
non-answer for the five §20.3 questions. Split admission, exposure, and
authorization without renaming schema fields. Finish the workplan.

Assistant: grok
Assistant-Session: 01a04c9f-cd6b-7741-bce0-f1d9d1b3c3bc

docs/adr/ADR-0006-reef-production-admission.md

@@ -4,7 +4,7 @@ title: "Reef Production Admission"
 status: accepted
 revision: "accepted-1"
 owner: railiance-master
-last_reviewed: "2026-08-15"
+last_reviewed: "2026-08-29"
 review_interval: 6m
 ---
 
@@ -36,6 +36,11 @@ Who may reach a listener is a different axis:
 admission does not imply a public surface. A public surface requires
 this admission **and** an exposure grant.
 
+Neither admission nor exposure is an authorization decision. Whether an
+actor may perform an action on a resource is `access-engine`
+([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)).
+`production-approved` MUST NOT be read as permission to act.
+
 ## Consequences
 
 - `hosts_rail` and `binds_rapp` no longer imply deployability.
@@ -44,3 +49,4 @@ this admission **and** an exposure grant.
 - Repeated evidence collection should become functional automation.
 - `production-approved` is not permission to publish a listener. See
   ADR-0008.
+- `production-approved` is not an authorization decision. See ADR-0009.