feat(RMASTER-WP-0026): declare Taxonomy layer and consume NetKingdom §20

Add layer.yaml, RMASTER-ADR-0009, the consumption contract, and a tracked
non-answer for the five §20.3 questions. Split admission, exposure, and
authorization without renaming schema fields. Finish the workplan.

Assistant: grok
Assistant-Session: 01a04c9f-cd6b-7741-bce0-f1d9d1b3c3bc

layer.yaml

@@ -0,0 +1,54 @@
+# railiance-master — NetKingdom security layer declaration
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
+# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
+# Assent:    docs/adr/ADR-0009-netkingdom-security-layer-interaction.md
+#
+# §11 requires a machine-readable declaration: prose cannot distinguish a
+# declaration from a transcribed review. Form adapted from the kings-guard
+# no-contact shape offered under §11.
+#
+# This repository produces terms, family contracts, and standards for
+# workload operations. It owns no runtime position and no state another
+# layer depends on. It is Taxonomy of Railiance operations, not a row in
+# the NetKingdom §4 security-estate catalog.
+#
+# It is not PEP-shaped: nothing here causes a protected side effect, so
+# there is no pep_stance path.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.7"
+repository: railiance-master
+layer: Taxonomy
+declared_by: docs/adr/ADR-0009-netkingdom-security-layer-interaction.md
+declared_at: "2026-08-29"
+pep_shaped: false
+
+catalog_entry:
+  note: >-
+    Not a NetKingdom §4 catalog row. This is Railiance operations Taxonomy,
+    not NetKingdom security Taxonomy. info-tech-canon remains ecosystem-wide
+    semantics; net-kingdom remains NetKingdom standards of record.
+
+# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling
+# row). Empty is a claim: this Taxonomy home holds no OpenBao, key-cape,
+# or cluster client.
+tooling_contacts: []
+
+# §11 requires non-Tooling clients to be recorded so the check is total.
+non_tooling_clients:
+  - id: state-hub-work-records
+    target: state-hub
+    layer: not-catalogued
+    operation: "HTTP to the Custodian State Hub for work records and progress events"
+    write: true
+    note: >-
+      Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
+      Tooling row, and state-hub is not one. Recorded, not policed. Carries
+      no security authority and no secret payload.
+
+declared_shapes:
+  "5.1": []
+  "5.2": []
+  "5.3": []