Close RAILIANCE-WP-0015-T02 platform rapp schema convergence

Converge the S3 platform-service pattern onto ADR-0007, emit the
reef-railiance live deployable inventory for the family coverage
check, and mark T02 done. Declaration edits land in rapp-openbao
and rapp-postgres.

docs/rapp-platform-service-pattern.md

@@ -70,10 +70,9 @@ applies decides it.
 
 ## Reference `rapp.yaml` for a platform service
 
-Pending the normative schema from `railiance-master`, a platform-service rapp
-should carry at least the following. Fields marked † are the consistency fields
-currently present in `rail.yaml` and `rapp-qonto` but missing from both platform
-rapps; `RAILIANCE-WP-0015-T02` adds them once the schema settles.
+The normative shape is `railiance-master/schemas/rapp.schema.json` (ADR-0007).
+A platform-service rapp fills that schema as follows. `RAILIANCE-WP-0015-T02`
+converged `rapp-openbao` and `rapp-postgres` onto this shape.
 
 ```yaml
 kind: managed-workload-package
@@ -81,10 +80,10 @@ repo_family: rapp
 rapp_id: rapp-<workload>
 repo: rapp-<workload>
 ownership_repo: railiance-platform      # the S3 home retaining governance
-contract_version: 1.0.0                 # †
-readiness_state: verified               # †
-data_classification: <internal|restricted>   # †
-criticality: <high|critical>            # †
+contract_version: 1.0.0
+readiness_state: verified
+data_classification: <internal|restricted>
+criticality: <high|critical>
 workload_identity:
   name: <workload>                      # the workload, never the repo name
   package_type: helm-managed-platform-service
@@ -93,10 +92,27 @@ workload_identity:
   app_version: <pinned>
 primary_rail: rail-kubernetes
 supported_rails: [rail-kubernetes]
-runtime_dependencies: [...]             # what must exist for this to run
-rollout_contract: {...}
-smoke_contract: {...}
-rollback_contract: {...}
+bound_reefs: [reef-railiance]           # empty only if the package is not placed
+runtime_dependencies: [...]             # capabilities, not the resource that satisfies them
+composition:
+  purpose: <what this coherent workload does>
+  member_repos:
+    - repo: rapp-<workload>             # single-repo rapp: one member, itself
+      role: <what it contributes>
+      deployables: [<running unit names>]
+  upstream_components:
+    - name: <chart|image>
+      source: <repo/chart or registry ref>
+      version: <exact pin>
+rollout_contract:
+  default_mode: <helm-upgrade-install|kubectl-server-side-apply>
+  commands: [...]                       # renamed from supported_commands
+smoke_contract:
+  required: [...]                       # outcomes the commands establish
+  commands: [...]
+rollback_contract:
+  order: [...]                          # most-preferred strategy first
+  commands: [...]
 source_documents: [...]
 ```
 
@@ -147,7 +163,7 @@ its rollout. That distinction is what makes the coverage check well-defined:
 
 A rapp declares what it combines: first-party repos and pinned third-party
 components, plus the purpose the combination serves. The normative shape is
-`railiance-master`'s to settle; the proposed form is:
+`railiance-master/schemas/rapp.schema.json`; the form is:
 
 ```yaml
 composition:
@@ -187,6 +203,20 @@ The existing rule holds without exception: the package never commits
 credentials, and a workload receives a short-lived lease through the platform
 broker rather than a package-managed secret.
 
+## Live deployable inventory
+
+`railiance-master` coverage check (`tools/validate-family-declarations.py
+--inventory`) must not query the cluster. S3 emits the interchange file:
+
+```text
+docs/evidence/reef-railiance-deployables.json
+```
+
+Refresh with `scripts/capture-reef-deployables.py -o docs/evidence/reef-railiance-deployables.json`.
+The file lists non-substrate Deployments, StatefulSets, CNPG Clusters, and
+Knative Services on `reef-railiance`. Declared `composition.member_repos.deployables`
+names must match these live names.
+
 ## When a platform service earns a rapp
 
 Not every S3 service needs one. A platform service is ready for extraction when