Add Knative and Qonto admission evidence

bindings/rails.yaml

@@ -2,5 +2,16 @@ reef_id: reef-railiance
 hosted_rails:
   - rail_id: rail-kubernetes
     role: primary
-    status: active
+    readiness_state: declared
+    contract_version: 1.0.0
+    evidence:
+      - evidence/admission/rail-kubernetes-baseline.json
     notes: First-wave default execution rail for the grouped Railiance home reef.
+  - rail_id: rail-knative
+    role: derived
+    readiness_state: declared
+    contract_version: 1.0.0
+    base_rail: rail-kubernetes
+    evidence:
+      - evidence/admission/rail-knative-baseline.json
+    notes: Declared second-wave rail; not installed or production-approved.

bindings/rapps.yaml

@@ -1,5 +1,10 @@
 reef_id: reef-railiance
-bound_rapps: []
+bound_rapps:
+  - rapp_id: rapp-qonto
+    rail_id: rail-knative
+    readiness_state: declared
+    evidence:
+      - ../rapp-qonto/docs/security-and-reliability-gates.md
 notes:
-  - No grouped home-reef workload bindings are declared yet.
-  - Add `rapp` bindings here only when the substrate decision is explicit and source-backed.
+  - The Qonto binding is topology-only until admission evidence supports promotion.
+  - Add or promote bindings only when the substrate decision is explicit and source-backed.