refactor(deployment): move PendingUpdatesCache to DeploymentManager so the CLI shares it (ScadaBridge#91)

`health pending-updates` (#63) called IPendingUpdatesEvaluator.EvaluateAsync directly
from ManagementActor because the cache lived in CentralUI, so every CLI call was a full
uncached fleet flatten. IPendingUpdatesCache/PendingUpdatesCache now live in
DeploymentManager.PendingUpdates and are registered by AddDeploymentManager; the
SingleFlightMemo<T> primitive moves to Commons.Caching (public) so both CentralUI's KPI /
alarm-summary caches and DeploymentManager can use it. HandleGetPendingUpdates reads the
shared cache; the UI circuits and the CLI now share one memo per node.

Tests: ManagementActor repeated-calls test (fails against the direct evaluator call:
2 evaluations instead of 1), AddDeploymentManager singleton-registration test; the cache
and memo tests move with their types.

(ScadaBridge#91)

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -3186,8 +3186,10 @@ public class ManagementActor : ReceiveActor
     /// </summary>
     private static async Task<object?> HandleGetPendingUpdates(IServiceProvider sp, AuthenticatedUser user)
     {
-        var evaluator = sp.GetRequiredService<IPendingUpdatesEvaluator>();
-        var snapshot = await evaluator.EvaluateAsync();
+        // The process-wide memo the Central UI also reads (Gitea #91): N CLI calls inside one
+        // cache TTL cost at most one fleet flatten, and a finished deployment on this node
+        // drops the memo so the CLI never reports a pre-deploy count after a local deploy.
+        var snapshot = await sp.GetRequiredService<IPendingUpdatesCache>().GetAsync();
         if (user.PermittedSiteIds.Length > 0 && !user.Roles.Contains(Roles.Administrator, StringComparer.OrdinalIgnoreCase))
         {
             var permitted = new HashSet<string>(user.PermittedSiteIds);