feat(deploy): ship the canon classification vocabulary with the release

The API validates repo classification against the-custodian canon allowed
values. A container has no such checkout, so every classification write failed
with a 500 and classification could only ever be written from a workstation.

Mounts the vocabulary as a ConfigMap and points
REPO_CLASSIFICATION_ALLOWED_PATH at it.

The copy is the risk, so it is owned rather than trusted:
scripts/sync_classification_allowed.py regenerates it from canon and --check
fails on drift. make check-classification-allowed and
make railiance-state-hub-render both refuse to proceed when the copy diverges,
so a release cannot silently validate against a stale vocabulary.

The container volumeMounts and env blocks are merged rather than appended —
a second pair would have produced duplicate YAML keys as soon as sweep was
re-enabled.

Refs CUST-WP-0067-T09

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

deploy/railiance/apps/charts/state-hub/templates/classification-configmap.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.classificationAllowed.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.classificationAllowed.name | quote }}
+  labels: {{- include "statehub.labels" . | nindent 4 }}
+data:
+  # Generated copy of the-custodian canon allowed-values. Kept in sync by
+  # scripts/sync_classification_allowed.py; `--check` fails the release on drift.
+  repo-classification.allowed.yaml: |
+{{ .Files.Get "files/repo-classification.allowed.yaml" | indent 4 }}
+{{- end }}

deploy/railiance/apps/charts/state-hub/templates/deployment.yaml

@@ -22,8 +22,9 @@ spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets: {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.sweep.enabled }}
+      {{- if or .Values.sweep.enabled .Values.classificationAllowed.enabled }}
       volumes:
+        {{- if .Values.sweep.enabled }}
         - name: sweep-repos
           hostPath:
             path: {{ .Values.sweep.hostPath | quote }}
@@ -32,6 +33,12 @@ spec:
           hostPath:
             path: {{ .Values.sweep.sshHostPath | quote }}
             type: DirectoryOrCreate
+        {{- end }}
+        {{- if .Values.classificationAllowed.enabled }}
+        - name: classification-allowed
+          configMap:
+            name: {{ .Values.classificationAllowed.name | quote }}
+        {{- end }}
       {{- end }}
       containers:
         - name: state-hub
@@ -50,17 +57,32 @@ spec:
                   - /bin/sh
                   - -c
                   - git config --global --add safe.directory '*'
+          {{- end }}
+          {{- if or .Values.sweep.enabled .Values.classificationAllowed.enabled }}
           volumeMounts:
+            {{- if .Values.sweep.enabled }}
             - name: sweep-repos
               mountPath: {{ .Values.sweep.hostPath | quote }}
             - name: sweep-ssh
               mountPath: /root/.ssh
               readOnly: true
+            {{- end }}
+            {{- if .Values.classificationAllowed.enabled }}
+            - name: classification-allowed
+              mountPath: {{ .Values.classificationAllowed.mountPath | quote }}
+              readOnly: true
+            {{- end }}
           env:
+            {{- if .Values.sweep.enabled }}
             - name: STATE_HUB_SWEEP_HOSTNAME
               value: {{ .Values.sweep.hostname | quote }}
             - name: GIT_SSH_COMMAND
               value: "ssh -o StrictHostKeyChecking=accept-new -F /root/.ssh/config"
+            {{- end }}
+            {{- if .Values.classificationAllowed.enabled }}
+            - name: REPO_CLASSIFICATION_ALLOWED_PATH
+              value: {{ printf "%s/repo-classification.allowed.yaml" .Values.classificationAllowed.mountPath | quote }}
+            {{- end }}
           {{- end }}
           envFrom:
             {{- if .Values.config.enabled }}