feat: add API-only preflight signing delivery and rotation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102

deploy/railiance/apps/charts/state-hub/templates/deployment.yaml

@@ -97,6 +97,14 @@ spec:
               readOnly: true
             {{- end }}
           env:
+            {{- if .Values.renamePreflight.enabled }}
+            - name: REPOSITORY_RENAME_PREFLIGHT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.renamePreflight.secretName | quote }}
+                  key: REPOSITORY_RENAME_PREFLIGHT_SECRET
+                  optional: false
+            {{- end }}
             - name: HOME
               value: /tmp
             {{- if .Values.sweep.enabled }}

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -190,3 +190,8 @@ sweep:
   hostname: ""
   hostPath: /home/tegwick
   sshHostPath: /home/tegwick/.ssh
+
+# RPF-WP-0035-T04: API-only, separately owned ESO Secret; no secret values here.
+renamePreflight:
+  enabled: false
+  secretName: state-hub-rename-preflight