feat: harden zone reference contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

fixtures/manifests/tenancy.yaml

@@ -0,0 +1,28 @@
+schema_version: "0.1"
+framework: netkingdom-tenancy-posture
+service: fixture-workload
+role: fixture
+workload_identity:
+  name: fixture-workload
+  kind: managed-deployable
+  responsible_repo: fixture-owner
+  identity_bindings:
+    - scheme: kubernetes-service-account
+      authority: railiance01
+      subject: system:serviceaccount:fixture:fixture-workload
+      principal_type: service
+tenancy: {}
+zones:
+  standard: security-zones_v0.1
+  membership: z2-protected
+  responsible_party: fixture-owner
+  justification: canonical resolver fixture
+  context:
+    maturity: M2
+    criticality: high
+    data_classification: internal
+  evidence:
+    - ref: fixture
+      supports: [M2]
+  reviewed: "2026-08-23"
+  review_due: "2026-11-23"