The edge renders the shared Middlewares a route names #580

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

The edge Project renders the shared Middlewares a route names: security-headers and one security-headers-<contentPolicy> per content policy any exposure declares, in the proxy's namespace. Today the traefik adapter names them while nothing renders them and none exists live, so every rendered route would point at a missing Middleware. Forward-auth is #396's. Found while planning the edge handover (#373, 2026-10-23).

Acceptance criteria

• Composition renders each shared Middleware a rendered route names, once, in the edge Project's artifact.
• A route naming a content policy no exposure declares is refused.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• Split the compiler's mixed modules by concept, with no change of behaviour