feat: harden zone reference contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

fixtures/manifests/adoption.yaml

@@ -0,0 +1,12 @@
+standard: zone-resolver-input_v0.1
+sources:
+  - path: ../../../flex-auth/tenancy.yaml
+    source_revision: flex-auth@00a7bc46090ceb71dc23fef0530629f18398d3b1
+  - path: ../../../ops-warden/tenancy.yaml
+    source_revision: ops-warden@c8fa02adf0ab9ef699508141f099bc71c38e76f3
+subjects:
+  - subject_id: human-operator
+    source: ops-warden/catalog@c8fa02adf0ab9ef699508141f099bc71c38e76f3
+    source_revision: ops-warden@c8fa02adf0ab9ef699508141f099bc71c38e76f3
+    workload_ref:
+      applicability: not-applicable

fixtures/manifests/reference.yaml

@@ -0,0 +1,16 @@
+standard: zone-resolver-input_v0.1
+sources:
+  - path: tenancy.yaml
+    source_revision: fixture-owner@abc123
+    workload_refs:
+      fixture-workload:
+        applicability: applicable
+        rapp_id: rapp-fixture
+        name: fixture-workload
+        deployable: fixture-workload
+subjects:
+  - subject_id: human-operator
+    source: fixture-catalog@abc123
+    source_revision: fixture-catalog@abc123
+    workload_ref:
+      applicability: not-applicable

fixtures/manifests/tenancy.yaml

@@ -0,0 +1,28 @@
+schema_version: "0.1"
+framework: netkingdom-tenancy-posture
+service: fixture-workload
+role: fixture
+workload_identity:
+  name: fixture-workload
+  kind: managed-deployable
+  responsible_repo: fixture-owner
+  identity_bindings:
+    - scheme: kubernetes-service-account
+      authority: railiance01
+      subject: system:serviceaccount:fixture:fixture-workload
+      principal_type: service
+tenancy: {}
+zones:
+  standard: security-zones_v0.1
+  membership: z2-protected
+  responsible_party: fixture-owner
+  justification: canonical resolver fixture
+  context:
+    maturity: M2
+    criticality: high
+    data_classification: internal
+  evidence:
+    - ref: fixture
+      supports: [M2]
+  reviewed: "2026-08-23"
+  review_due: "2026-11-23"