fix registrar writebacks and own the State Hub access map

Ignore generated WORK-RECORDS.md/.custodian-brief.md in the registrar git
precondition, commit identifier writebacks even when registration is
incomplete, and name the remaining records in the error. Add
config/state-hub-access.yaml as the single source for the AGENTS.md port
map, rendered by rmgr scaffold and refreshed with --refresh-hub-access.

Assistant: grok
Assistant-Session: 01a04996-76e8-7f53-b971-1885cfbed436

tests/test_hub_access.py

@@ -0,0 +1,87 @@
+from pathlib import Path
+
+from repo_manager.cli import main
+from repo_manager.commands.scaffold import refresh_hub_access, scaffold_repository
+from repo_manager.hub_access import (
+    apply_hub_access_block,
+    live_urls,
+    render_hub_access_block,
+    retired_urls,
+)
+
+
+def test_canonical_map_matches_live_topology() -> None:
+    urls = live_urls()
+    assert "http://127.0.0.1:8000" in urls
+    assert "http://10.43.68.154:8000" in urls
+    assert "http://127.0.0.1:18000" not in urls
+    assert "http://127.0.0.1:18000" in retired_urls()
+
+
+def test_rendered_table_does_not_instruct_retired_tunnel() -> None:
+    block = render_hub_access_block()
+    table, _, note = block.partition("\n\n")
+    assert "`http://10.43.68.154:8000`" in table
+    assert "`http://127.0.0.1:18000`" not in table
+    assert "127.0.0.1:18000" in note
+
+
+def test_replace_unmarked_table_and_idempotent_refresh() -> None:
+    original = (
+        "# Agent instructions\n\n"
+        "## State Hub Integration\n\n"
+        "| Context | URL |\n"
+        "|---------|-----|\n"
+        "| Local workstation | `http://127.0.0.1:8000` |\n"
+        "| Remote (railiance01, in-cluster) | `http://127.0.0.1:18000` |\n\n"
+        "More prose.\n"
+    )
+    updated, action = apply_hub_access_block(original)
+    assert action == "replaced-table"
+    assert "127.0.0.1:18000" not in updated.split("Do not instruct")[0]
+    again, second = apply_hub_access_block(updated)
+    assert second == "noop"
+    assert again == updated
+
+
+def test_scaffold_writes_canonical_access_table(tmp_path: Path) -> None:
+    dest = tmp_path / "access-tool"
+    result = scaffold_repository(dest, flavor="tooling", commit=False)
+    assert result.status == "applied"
+    agents = (dest / "AGENTS.md").read_text(encoding="utf-8")
+    assert "<!-- BEGIN STATE-HUB-ACCESS -->" in agents
+    assert "http://10.43.68.154:8000" in agents
+    assert "| Remote (railiance01, in-cluster) | `http://127.0.0.1:18000` |" not in agents
+
+
+def test_refresh_hub_access_rewrites_stale_table(tmp_path: Path) -> None:
+    dest = tmp_path / "stale-repo"
+    dest.mkdir()
+    (dest / "AGENTS.md").write_text(
+        "# Agent instructions — stale-repo\n\n"
+        "## State Hub Integration\n\n"
+        "| Context | URL |\n"
+        "|---------|-----|\n"
+        "| Local workstation | `http://127.0.0.1:8000` |\n"
+        "| Remote (railiance01, in-cluster) | `http://127.0.0.1:18000` |\n",
+        encoding="utf-8",
+    )
+    result = refresh_hub_access(dest, commit=False)
+    assert result.status == "applied"
+    assert result.evidence["action"] == "replaced-table"
+    text = (dest / "AGENTS.md").read_text(encoding="utf-8")
+    assert "10.43.68.154:8000" in text
+    assert "| Remote (railiance01, in-cluster) | `http://127.0.0.1:18000` |" not in text
+
+
+def test_cli_refresh_hub_access(tmp_path: Path) -> None:
+    dest = tmp_path / "cli-refresh"
+    dest.mkdir()
+    (dest / "AGENTS.md").write_text("# Agent instructions\n", encoding="utf-8")
+    assert (
+        main(["scaffold", "--path", str(dest), "--refresh-hub-access", "--no-commit"])
+        == 0
+    )
+    text = (dest / "AGENTS.md").read_text(encoding="utf-8")
+    assert "<!-- BEGIN STATE-HUB-ACCESS -->" in text
+    assert "10.43.68.154:8000" in text