feat: interim identifier registrar (RMGR-WP-0005-T01)

Add is_identifier_registrar so only the production instance may mint
hub UUIDs into repository files. Workstation hubs stay read/project
caches until deterministic derivation lands.

Also close RMGR-WP-0004-T05: register cutover is STATE-WP-0080-T02.

tests/test_registrar.py

@@ -0,0 +1,25 @@
+from repo_manager.registrar import is_identifier_registrar
+
+
+def test_env_true_wins_over_hostname(monkeypatch):
+    monkeypatch.setenv("STATEHUB_REGISTRAR", "1")
+    assert is_identifier_registrar(hostname="bnt-lap001") is True
+
+
+def test_env_false_wins_over_production_hostname(monkeypatch):
+    monkeypatch.setenv("STATEHUB_REGISTRAR", "0")
+    assert is_identifier_registrar(hostname="railiance") is False
+
+
+def test_hostname_prefix_when_env_unset(monkeypatch):
+    monkeypatch.delenv("STATEHUB_REGISTRAR", raising=False)
+    assert is_identifier_registrar(hostname="railiance") is True
+    assert is_identifier_registrar(hostname="railiance-prod") is True
+    assert is_identifier_registrar(hostname="bnt-lap001") is False
+
+
+def test_env_aliases(monkeypatch):
+    monkeypatch.setenv("STATEHUB_REGISTRAR", "yes")
+    assert is_identifier_registrar(hostname="other") is True
+    monkeypatch.setenv("STATEHUB_REGISTRAR", "off")
+    assert is_identifier_registrar(hostname="railiance") is False