feat(workloads): define authoritative reference contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/workload-reference-contract_v1.yaml

@@ -0,0 +1,35 @@
+contract: helixforge.workload-reference
+version: 1
+status: active
+authority:
+  semantic_schema: railiance-master/schemas/rapp.schema.json
+  record_pattern: rapp-*/declarations/rapp.yaml
+  indexer: repo-manager
+reference:
+  required:
+    - rapp_id
+    - name
+  optional:
+    - deployable
+  source_fields:
+    rapp_id: rapp_id
+    name: workload_identity.name
+    deployable: composition.member_repos[].deployables[]
+  forbidden_fallbacks:
+    - repository_name
+    - owner_repo
+    - path_segment
+resolution:
+  producer_states:
+    - resolved
+    - unknown
+  consumer_asserted_states:
+    - not-applicable
+  unknown_reasons:
+    - not_found
+    - ambiguous
+    - deployable_not_declared
+consumer_rules:
+  ops-warden: owns lane reference and applicability
+  zone-engine: consumes references without identity inference
+  hub-core: transports normalized projection without assuming authority