Accept the workplan home and tighten scope: exposure sits
beside ADR-0006 as ADR-0008, public keys off binding
admission, T04 is a reef-railiance snapshot, enforcement
is routed, and Q7 / provider APIs stay out.
Draft family workplan for review. Default reefs, rails, and rapps stay
off the public internet until production-approved plus an explicit
grant. Implementation is routed, not done here.
