Secondary question: Is it possible to deploy an instance of Cerbos Hub into an airgapped, on-prem environment?

No, not currently. It's a concept we've discussed loosely, but isn't on our short/mid term roadmap.