feat: add reversible SBOM Nexus read facade

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

deploy/railiance/apps/charts/state-hub/templates/configmap.yaml

@@ -6,4 +6,6 @@ metadata:
   labels: {{- include "statehub.labels" . | nindent 4 }}
 data:
   CORS_ORIGINS: {{ .Values.config.corsOrigins | quote }}
-{{- end }}
+  SBOM_NEXUS_URL: {{ .Values.config.sbomNexusUrl | quote }}
+  SBOM_NEXUS_READ_MODE: {{ .Values.config.sbomNexusReadMode | quote }}
+{{- end }}

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -22,6 +22,8 @@ config:
   enabled: true
   name: state-hub-config
   corsOrigins: "http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001"
+  sbomNexusUrl: ""
+  sbomNexusReadMode: legacy
 
 secret:
   name: state-hub-env
@@ -71,4 +73,4 @@ sweep:
   enabled: false
   hostname: ""
   hostPath: /home/tegwick
-  sshHostPath: /home/tegwick/.ssh
+  sshHostPath: /home/tegwick/.ssh

deploy/railiance/apps/helm/state-hub-values.yaml

@@ -11,6 +11,11 @@ image:
 ingress:
   enabled: false
 
+config:
+  sbomNexusUrl: "http://sbom-nexus.sbom-nexus.svc.cluster.local:8010"
+  # T04 starts fail-safe. Change only this value to `nexus` after parity checks.
+  sbomNexusReadMode: legacy
+
 sweep:
   # RMGR-WP-0005-T11: disabled while railiance01 checkouts still target the
   # stale gitea-remote lineage. Re-enable only after the governed remote