feat: add migration export and write fencing

tests/test_api_v2.py

@@ -1,3 +1,6 @@
+from core_hub.config import get_settings
+
+
 CATALOG_ENDPOINTS = [
     "/api/v2/widget-types",
     "/api/v2/event-types",
@@ -37,6 +40,20 @@ def test_protected_api_v2_endpoints_fail_before_business_logic(client):
         assert response.json()["detail"]["code"] == "unauthorized"
 
 
+def test_disabled_write_group_fails_closed(client, monkeypatch):
+    monkeypatch.setenv("CORE_HUB_V2_WRITE_GROUPS", "credentials")
+    get_settings.cache_clear()
+    response = client.post(
+        "/api/v2/hubs",
+        headers=OPERATOR_HEADERS,
+        json={"slug": "blocked", "name": "Blocked"},
+    )
+    get_settings.cache_clear()
+
+    assert response.status_code == 503
+    assert response.json()["detail"]["group"] == "registry"
+
+
 def test_openapi_contains_ops_hub_gate_paths(client):
     payload = client.get("/api/v2/openapi.json").json()