feat(statehub): add railiance deployment manifests

workplans/CUST-WP-0011-state-hub-threephoenix-migration.md

@@ -225,8 +225,9 @@ and verified railiance01 can pull it with `sudo crictl pull`.
 
 ```task
 id: CUST-WP-0011-T04
-status: todo
+status: done
 priority: high
+completed: "2026-06-25"
 state_hub_task_id: "a7baf2eb-abd7-4aa3-b2cb-a5370ac09844"
 ```
 
@@ -241,6 +242,24 @@ Create the cluster-side deployment assets using current Railiance boundaries:
 **Done when:** manifests lint/apply in a non-destructive dry run and ownership
 boundaries are documented.
 
+Completed 2026-06-25: added a source-owned Railiance deployment handoff under
+`deploy/railiance/` with platform manifests for `state-hub-db` CNPG, database
+credentials, database NetworkPolicies, an app Helm chart, production values, and
+a `state-hub-env` Secret template. Added Make targets for rendering,
+client-side dry-run validation, and namespace-aware server-side dry-run
+validation. Verified:
+
+- `make railiance-state-hub-render`
+- `make railiance-state-hub-client-dry-run`
+- `make railiance-state-hub-server-dry-run`
+
+The server dry-run validates platform resources and the Namespace manifest
+against the live cluster API. Because the `state-hub` namespace does not yet
+exist, it explicitly falls back to client dry-run for namespaced app manifests;
+Kubernetes cannot persist a dry-run Namespace for subsequent namespaced
+server-side validation. Ownership boundaries and promotion notes are documented
+in `deploy/railiance/README.md`.
+
 ---
 
 ### T05 — Deploy empty State Hub and run migrations on railiance01