_allowed_path() tried three developer workstation checkouts and nothing else,
so in a container none exist and every classification write fails with a 500.
That is why repo classification could only ever be written from a workstation.
Adds REPO_CLASSIFICATION_ALLOWED_PATH, checked first, and names it in the
error when no candidate is found.
Refs CUST-WP-0067-T04
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
Add git/ssh to the runtime image, mount /home/tegwick into the state-hub pod,
resolve host_paths via STATE_HUB_SWEEP_HOSTNAME, and fall back to the
railiance01 the-custodian canon path for classification validation.