test(rig): site secrets gate covers the follow-ups — standby KEK mismatch on the health report, removal audit, CLI exit codes — PASS 9/9

Also: DeploymentDeadlineParityTests' stub replies with a real zero-failure summary (the artifact
aliases now derive their exit code from failureCount), and register row 127 reflects the merge
and the two new replicated site tables.

tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/DeploymentDeadlineParityTests.cs

@@ -50,7 +50,11 @@ public class DeploymentDeadlineParityTests
                 using var payload = JsonDocument.Parse(new string(request));
                 Assert.Equal(expectedCommand, payload.RootElement.GetProperty("command").GetString());
                 await Task.Delay(TimeSpan.FromSeconds(31), deadline.Token);
-                var reply = Encoding.ASCII.GetBytes("HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{}");
+                // A zero-failure summary: the artifact-deploy aliases derive their exit code from
+                // failureCount, so a bare "{}" would read as an invalid summary (exit 1).
+                const string body = "{\"successCount\":1,\"failureCount\":0}";
+                var reply = Encoding.ASCII.GetBytes(
+                    $"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {body.Length}\r\nConnection: close\r\n\r\n{body}");
                 try { await stream.WriteAsync(reply, deadline.Token); }
                 catch (IOException) { /* Old client closes at 30s; exit assertion diagnoses it. */ }
             }, deadline.Token);