feat: greenfield rapp wrap path and rail-sequence rules

Add the §0 playbook and kubernetes-then-knative gate to the guide.
Implement rmgr rapp skeleton/wrap/place, draft postgres consumers,
and copy the fleet image workflow when missing.

tests/test_rapp_scaffold.py

@@ -1,7 +1,7 @@
 from pathlib import Path
 
 from repo_manager.cli import main
-from repo_manager.commands.rapp import init, pin_image, validate
+from repo_manager.commands.rapp import init, pin_image, place, skeleton, validate, wrap
 
 
 def test_init_refuses_rapp_prefixed_app(tmp_path: Path):
@@ -57,3 +57,56 @@ def test_cli_init_and_pin(tmp_path: Path, capsys):
     assert main(["rapp", "pin-image", "--path", str(dest), "--digest", "latest"]) == 1
     out = capsys.readouterr().out
     assert "sha256" in out or "digest" in out
+
+
+def test_skeleton_from_containerfile(tmp_path: Path):
+    app = tmp_path / "demo"
+    app.mkdir()
+    (app / "Containerfile").write_text(
+        "FROM python:3.12-slim\nUSER 10001\nEXPOSE 8090\n"
+    )
+    dest = tmp_path / "rapp-demo"
+    init(dest, app="demo", ownership_repo="demo")
+    built = skeleton(dest, from_app=app, app="demo")
+    assert built["ok"] is True
+    runtime = (dest / "manifests" / "runtime.yaml").read_text()
+    assert "containerPort: 8090" in runtime
+    assert "runAsUser: 10001" in runtime
+    refused = skeleton(dest, from_app=app, app="demo")
+    assert refused["ok"] is False
+
+
+def test_place_refuses_storage_and_sets_compute(tmp_path: Path):
+    dest = tmp_path / "rapp-demo"
+    init(dest, app="demo", ownership_repo="demo")
+    assert place(dest, reef="reef-storage")["ok"] is False
+    assert place(dest, reef="not-a-reef")["ok"] is False
+    placed = place(dest, reef="reef-railiance")
+    assert placed["ok"] is True
+    assert "- reef-railiance" in (dest / "declarations" / "rapp.yaml").read_text()
+
+
+def test_wrap_absorbs_deploy_and_skips_existing_consumer(tmp_path: Path):
+    app = tmp_path / "demo"
+    (app / "deploy").mkdir(parents=True)
+    (app / "Containerfile").write_text("USER 10001\nEXPOSE 8080\n")
+    (app / "deploy" / "demo.yaml").write_text(
+        "apiVersion: apps/v1\nkind: Deployment\n"
+        "metadata: {name: demo}\n"
+    )
+    postgres = tmp_path / "rapp-postgres" / "consumers"
+    postgres.mkdir(parents=True)
+    (postgres / "demo.yaml").write_text("kind: PostgresConsumer\n")
+    dest = tmp_path / "rapp-demo"
+    result = wrap(
+        dest,
+        app="demo",
+        ownership_repo="demo",
+        from_app=app,
+        family_root=tmp_path,
+    )
+    assert result["ok"] is True or "validate" in result
+    assert (dest / "manifests" / "demo.yaml").is_file()
+    assert result["postgres_consumer"]["written"] is False
+    assert result["applied"] is False
+    assert result["placed"] is False