Onboard tenant-engine to the staged-promotion contract

TEN-WP-0008. railiance/app.toml declares criticality=high, empty secrets,
isolated canary, and the live PostgreSQL digest as previous_stable.
Manifests render through kustomize (deploy/ and deploy/canary/). Stage 1
passed. Stage 2/3 Helm-only CLI gap requested as RAIL-BS-IN-0001 rather
than a dummy chart.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

tests/validate_app_toml.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""Validate railiance/app.toml against the railiance.app.v1 schema."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CONTRACT = ROOT / "railiance" / "app.toml"
+SCHEMA_CANDIDATES = [
+    Path.home() / "railiance-bootstrap" / "schemas" / "railiance-app.schema.json",
+    Path.home() / "railiance-cluster" / "schemas" / "railiance-app.schema.json",
+]
+
+
+def main() -> int:
+    schema_path = next((path for path in SCHEMA_CANDIDATES if path.exists()), None)
+    if schema_path is None:
+        print(
+            "railiance-app.schema.json not found in railiance-bootstrap or railiance-cluster",
+            file=sys.stderr,
+        )
+        return 1
+    try:
+        import jsonschema
+    except ImportError:
+        print("jsonschema is required to validate railiance/app.toml", file=sys.stderr)
+        return 1
+
+    document = tomllib.loads(CONTRACT.read_text())
+    schema = json.loads(schema_path.read_text())
+    jsonschema.validate(document, schema)
+    print(f"valid {CONTRACT.relative_to(ROOT)} against {schema_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())