fix(config): bind the instance-identity settings to the env vars the chart sets

pydantic-settings derives the env var from the field name, so `instance_role`
bound INSTANCE_ROLE and silently ignored the chart's STATE_HUB_INSTANCE_ROLE.
The value reached the pod and was discarded: central reported "unknown" while
its ConfigMap said "primary".

That is the same failure this workplan closes — configuration declared but
never reaching what it configures — reintroduced while building the guard
against it. Rendering the key in `helm template` was mistaken for evidence
that it bound.

Renames to state_hub_instance_role / state_hub_instance_label, matching the
existing state_hub_report_dir precedent, so the env var the chart already sets
is the one that binds.

tests/test_instance_identity.py asserts the env var *name* binds, which is the
check that would have caught this before deploy, plus the unknown default and
rejection of invalid roles.

Refs CUST-WP-0067-T03

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

tests/test_instance_identity.py

@@ -0,0 +1,38 @@
+"""The instance-identity env vars must actually bind (CUST-WP-0067-T03).
+
+The chart sets STATE_HUB_INSTANCE_ROLE. pydantic-settings derives the env var
+from the *field name*, so a field called `instance_role` silently ignores it and
+the hub reports "unknown" while the ConfigMap says "primary" — config that is
+declared but never reaches what it configures, which is the entire failure this
+workplan exists to close.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from api.config import Settings
+
+
+@pytest.mark.parametrize(
+    "env_name,attr,value",
+    [
+        ("STATE_HUB_INSTANCE_ROLE", "state_hub_instance_role", "primary"),
+        ("STATE_HUB_INSTANCE_LABEL", "state_hub_instance_label", "railiance01"),
+    ],
+)
+def test_env_var_binds_to_setting(monkeypatch, env_name, attr, value):
+    monkeypatch.setenv(env_name, value)
+    assert getattr(Settings(), attr) == value
+
+
+def test_role_defaults_to_unknown(monkeypatch):
+    """An instance that has not declared itself is not the primary."""
+    monkeypatch.delenv("STATE_HUB_INSTANCE_ROLE", raising=False)
+    assert Settings().state_hub_instance_role == "unknown"
+
+
+def test_role_rejects_unknown_values(monkeypatch):
+    monkeypatch.setenv("STATE_HUB_INSTANCE_ROLE", "authoritative")
+    with pytest.raises(Exception):
+        Settings()