fix(registrar): make --confirm-primary assert authority, not liveness

_check_primary accepted any instance reporting status=ok and db=connected.
A local cache and the central hub both satisfied that for seven weeks while
every registration went to the cache — a liveness check wearing an authority
check's name.

It now requires the hub to declare instance_role=primary. An instance that
declares nothing is refused with a message naming what to set; proceeding
anyway requires an explicit --allow-unverified-primary rather than a silent
default.

Four tests cover the logic directly; the existing suite stubbed _check_primary
and never exercised it.

Refs CUST-WP-0067-T03

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

src/repo_manager/cli.py

@@ -64,6 +64,12 @@ def main(argv: list[str] | None = None) -> int:
         help="Confirm that --api-base is the authoritative hub",
     )
     p_registrar.add_argument("--push", action="store_true", help="Push the registrar commit")
+    p_registrar.add_argument(
+        "--allow-unverified-primary",
+        action="store_true",
+        help="Proceed when the hub declares no instance role. Explicit on purpose: "
+             "the alternative is silently trusting whatever answered.",
+    )
     registrar_mode = p_registrar.add_mutually_exclusive_group()
     registrar_mode.add_argument(
         "--repair-workplan",
@@ -517,6 +523,7 @@ def main(argv: list[str] | None = None) -> int:
             api_base=args.api_base,
             statehub_bin=args.statehub_bin,
             confirm_primary=args.confirm_primary,
+            allow_unverified_primary=args.allow_unverified_primary,
             push=args.push,
             repair_workplan=args.repair_workplan,
             bootstrap_empty_projection=args.bootstrap_empty_projection,