feat: route SBOM writes to Nexus behind flag

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

deploy/railiance/apps/charts/state-hub/templates/configmap.yaml

@@ -8,4 +8,5 @@ data:
   CORS_ORIGINS: {{ .Values.config.corsOrigins | quote }}
   SBOM_NEXUS_URL: {{ .Values.config.sbomNexusUrl | quote }}
   SBOM_NEXUS_READ_MODE: {{ .Values.config.sbomNexusReadMode | quote }}
+  SBOM_NEXUS_WRITE_MODE: {{ .Values.config.sbomNexusWriteMode | quote }}
 {{- end }}

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -24,6 +24,7 @@ config:
   corsOrigins: "http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001"
   sbomNexusUrl: ""
   sbomNexusReadMode: legacy
+  sbomNexusWriteMode: legacy
 
 secret:
   name: state-hub-env

deploy/railiance/apps/helm/state-hub-values.yaml

@@ -15,6 +15,8 @@ config:
   sbomNexusUrl: "http://sbom-nexus.sbom-nexus.svc.cluster.local:8010"
   # Reversible T04 read cutover; set back to `legacy` to roll back.
   sbomNexusReadMode: nexus
+  # Write authority moves only after the independently flagged image is live.
+  sbomNexusWriteMode: legacy
 
 resources:
   # The single 4-core node currently has less than 250m unallocated. Keep enough