fix(site-secrets): contain secret-store outages per site; audit removal-only deploys

Secret-store outage (final review M5): SiteSecretsCollector returns a store
read failure as SiteSecretsCollection.StoreError instead of throwing. A deploy
now fails only the sites that reference a secret (nothing sent, not stamped,
DeploySiteSecrets row with the error), and ComputeCurrentArtifactHashesAsync
omits only those sites (they read Out of date) instead of the exception
aborting the whole sweep and the fleet-wide pending-updates check.

Removal-only deploys: the site reply gains SecretsRemoved (proto field 7,
names only) - the deployed_secrets rows the deploy soft-removed. Central
carries it on SiteArtifactResult and writes the DeploySiteSecrets row with a
removed list whenever it is non-empty, so dropping a site's last secret:
reference is audited centrally rather than only in site logs.

tests/ZB.MOM.WW.ScadaBridge.DeploymentManager.Tests/SiteSecretsCollectorTests.cs

@@ -100,6 +100,40 @@ public class SiteSecretsCollectorTests
         Assert.Empty(result.Missing);
     }
 
+    [Fact]
+    public async Task Collect_StoreThrows_ReturnsStoreError_InsteadOfThrowing()
+    {
+        // Final review M5: one site's store read failing must not abort a whole sweep.
+        var store = new FakeSecretStore(Row("a", 1)) { Fault = new InvalidOperationException("db down") };
+
+        var result = await new SiteSecretsCollector(store).CollectAsync(
+            [Dc("GW1", """{"ApiKey":"secret:a"}""")], default);
+
+        Assert.NotNull(result.StoreError);
+        Assert.Contains("'a'", result.StoreError);
+        Assert.Contains("InvalidOperationException: db down", result.StoreError);
+    }
+
+    [Fact]
+    public async Task Collect_CallerCancellation_StillPropagates()
+    {
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+        var store = new FakeSecretStore(Row("a", 1)) { Fault = new OperationCanceledException(cts.Token) };
+
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => new SiteSecretsCollector(store).CollectAsync(
+            [Dc("GW1", """{"ApiKey":"secret:a"}""")], cts.Token));
+    }
+
+    [Fact]
+    public async Task Collect_Success_HasNoStoreError()
+    {
+        var result = await new SiteSecretsCollector(new FakeSecretStore(Row("a", 1))).CollectAsync(
+            [Dc("GW1", """{"ApiKey":"secret:a"}""")], default);
+
+        Assert.Null(result.StoreError);
+    }
+
     /// <summary>
     /// In-memory <see cref="ISecretStore"/> stand-in. Implements only <see cref="GetAsync"/> —
     /// the sole member <see cref="SiteSecretsCollector"/> calls; every other member throws so an
@@ -112,8 +146,13 @@ public class SiteSecretsCollectorTests
 
         public FakeSecretStore(params StoredSecret[] rows) => _rows = rows.ToDictionary(r => r.Name);
 
+        /// <summary>When set, <see cref="GetAsync"/> throws this instead of reading.</summary>
+        public Exception? Fault { get; init; }
+
         public Task<StoredSecret?> GetAsync(SecretName name, CancellationToken ct) =>
-            Task.FromResult(_rows.TryGetValue(name, out var row) ? row : null);
+            Fault is not null
+                ? Task.FromException<StoredSecret?>(Fault)
+                : Task.FromResult(_rows.TryGetValue(name, out var row) ? row : null);
 
         public Task UpsertAsync(StoredSecret row, CancellationToken ct) => throw new NotSupportedException();