feat(deploy): ship the canon classification vocabulary with the release

The API validates repo classification against the-custodian canon allowed
values. A container has no such checkout, so every classification write failed
with a 500 and classification could only ever be written from a workstation.

Mounts the vocabulary as a ConfigMap and points
REPO_CLASSIFICATION_ALLOWED_PATH at it.

The copy is the risk, so it is owned rather than trusted:
scripts/sync_classification_allowed.py regenerates it from canon and --check
fails on drift. make check-classification-allowed and
make railiance-state-hub-render both refuse to proceed when the copy diverges,
so a release cannot silently validate against a stale vocabulary.

The container volumeMounts and env blocks are merged rather than appended —
a second pair would have produced duplicate YAML keys as soon as sweep was
re-enabled.

Refs CUST-WP-0067-T09

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -47,6 +47,15 @@ ingress:
     traefik.ingress.kubernetes.io/router.tls: "true"
     cert-manager.io/cluster-issuer: letsencrypt-prod
 
+# Classification allowed-values (CUST-WP-0067-T09). The API validates repo
+# classification against the-custodian canon; a container has no such checkout,
+# so the file travels with the release as a ConfigMap. Without it every
+# classification write fails with a 500.
+classificationAllowed:
+  enabled: true
+  name: state-hub-classification-allowed
+  mountPath: /etc/state-hub/classification
+
 # MCP layer (CUST-WP-0067-T08). Runs from the same image with a different
 # command, as a stateless HTTP client over the API service. ClusterIP only —
 # it proxies an unauthenticated API, so it must never gain an Ingress.