fix registrar writebacks and own the State Hub access map

Ignore generated WORK-RECORDS.md/.custodian-brief.md in the registrar git
precondition, commit identifier writebacks even when registration is
incomplete, and name the remaining records in the error. Add
config/state-hub-access.yaml as the single source for the AGENTS.md port
map, rendered by rmgr scaffold and refreshed with --refresh-hub-access.

Assistant: grok
Assistant-Session: 01a04996-76e8-7f53-b971-1885cfbed436

config/state-hub-access.yaml

@@ -0,0 +1,19 @@
+schema: repo-manager.state-hub-access.v1
+updated: "2026-08-28"
+workplan_task: CUST-WP-0067-T07
+notes: >
+  Authoritative State Hub access map for agent-facing AGENTS.md tables.
+  Edit this file, then `rmgr scaffold --path <repo> --refresh-hub-access`.
+  Local 127.0.0.1:8000 is central via ops-bridge state-hub-primary, not a cache.
+
+endpoints:
+  - context: Local workstation
+    url: http://127.0.0.1:8000
+  - context: Remote (railiance01, in-cluster)
+    url: http://10.43.68.154:8000
+  - context: Optional local edge relay
+    url: http://127.0.0.1:18080
+
+retired:
+  - url: http://127.0.0.1:18000
+    reason: reverse tunnel back to the workstation; the hub is in-cluster on railiance01