feat(state): let the hub declare what instance it is

Answering on a port was the only evidence callers had that they had reached
the authoritative hub. A local cache and central both served port 8000,
separated only by IP family, and every default reached the cache for seven
weeks (ADR-010).

Adds instance_role and instance_label, surfaced on /state/health. The default
is "unknown" on purpose: an instance that has not declared itself is not the
primary. Production values declare primary/railiance01; the chart default
stays unknown because a chart can be installed anywhere.

statehub status now prints which instance answered.

Refs CUST-WP-0067-T03

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

deploy/railiance/apps/charts/state-hub/templates/configmap.yaml

@@ -9,4 +9,8 @@ data:
   SBOM_NEXUS_URL: {{ .Values.config.sbomNexusUrl | quote }}
   SBOM_NEXUS_READ_MODE: {{ .Values.config.sbomNexusReadMode | quote }}
   SBOM_NEXUS_WRITE_MODE: {{ .Values.config.sbomNexusWriteMode | quote }}
+  # What this instance claims to be. Callers that need the authoritative hub
+  # check this rather than assuming whatever answered is central.
+  STATE_HUB_INSTANCE_ROLE: {{ .Values.config.instanceRole | quote }}
+  STATE_HUB_INSTANCE_LABEL: {{ .Values.config.instanceLabel | quote }}
 {{- end }}

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -25,6 +25,10 @@ config:
   sbomNexusUrl: ""
   sbomNexusReadMode: legacy
   sbomNexusWriteMode: legacy
+  # CUST-WP-0067-T03. "unknown" is the honest default for a chart that could be
+  # installed anywhere; the production values set this to primary.
+  instanceRole: unknown
+  instanceLabel: ""
 
 secret:
   name: state-hub-env

deploy/railiance/apps/helm/state-hub-values.yaml

@@ -19,6 +19,10 @@ mcp:
   enabled: true
 
 config:
+  # This deployment is the authoritative hub. Callers verify this rather than
+  # trusting that whatever answered on a port is central (CUST-WP-0067-T03).
+  instanceRole: primary
+  instanceLabel: railiance01
   sbomNexusUrl: "http://sbom-nexus.sbom-nexus.svc.cluster.local:8010"
   # Reversible T04 read cutover; set back to `legacy` to roll back.
   sbomNexusReadMode: nexus