In a private fork that tracks upstream qm, where should org-specific customizations live?

Answer

deploy/layers/<org>/

Core stays byte-identical to upstream; org config, sandbox tools/skills, and infra live under deploy/layers/.