Implement NK-WP-0013 playbook capability contract

docs/platform-identity-security-architecture.md

@@ -326,6 +326,13 @@ ADR-0007 records the current decision: keep orchestration in Railiance
 playbooks for now, with NetKingdom defining the trust-state model,
 readiness checks, OpenBao boundaries, and security semantics.
 
+The playbook interface for that split is the NetKingdom Playbook
+Capability Contract (`canon/standards/playbook-capability-contract_v0.1.md`).
+Railiance playbooks publish declarations beside the playbooks; NetKingdom
+validates and consumes those declarations to select capabilities,
+parametrize allowed inputs, and assemble responsibility/trust-state
+views without taking over execution.
+
 ## flex-auth And Topaz Implications
 
 flex-auth work must preserve the recursive boundary between platform