feat(deploy): railiance01 consistency sweep host mount and hostname override

Add git/ssh to the runtime image, mount /home/tegwick into the state-hub pod,
resolve host_paths via STATE_HUB_SWEEP_HOSTNAME, and fall back to the
railiance01 the-custodian canon path for classification validation.

scripts/consistency_check.py

@@ -70,6 +70,11 @@ _REPO_ROOT = Path(__file__).resolve().parent.parent
 if str(_REPO_ROOT) not in sys.path:
     sys.path.insert(0, str(_REPO_ROOT))
 
+def _sweep_hostname() -> str:
+    """Hostname for host_paths resolution; override when pod hostname != fleet FQDN."""
+    return os.environ.get("STATE_HUB_SWEEP_HOSTNAME", "").strip() or socket.gethostname()
+
+
 from api.workplan_status import (  # noqa: E402
     CANONICAL_WORKSTREAM_STATUSES,
     CLOSED_WORKSTREAM_STATUSES,
@@ -617,7 +622,7 @@ def resolve_repo_path(repo: dict, override: str | None = None) -> str:
     """
     if override:
         return override
-    hostname = socket.gethostname()
+    hostname = _sweep_hostname()
     host_paths = repo.get("host_paths") or {}
     return host_paths.get(hostname) or repo.get("local_path") or ""
 
@@ -1692,7 +1697,7 @@ def fix_repo(
     if repo_path:
         repo_record = _api_get(api_base, f"/repos/{repo_slug}")
         if repo_record:
-            hostname = socket.gethostname()
+            hostname = _sweep_hostname()
             if (repo_record.get("host_paths") or {}).get(hostname) != repo_path:
                 result = _api_post(
                     api_base, f"/repos/{repo_slug}/paths",
@@ -2491,7 +2496,7 @@ def main() -> None:
             sys.exit(0)
     else:
         # Resolve repo list
-        hostname = socket.gethostname()
+        hostname = _sweep_hostname()
         repo_slugs: list[str] = []
         if args.all:
             repos = _api_get(args.api_base, "/repos")