infra(docker)+test(siteeventlog): close register tripwires 79 + 93 — rig data to named volumes; pin site_events schema to the cap-model calibration

Row 79 executed its own prescribed remedy without waiting for a second
corruption: all ten rig data dirs (8 docker/ nodes + 2 docker-env2/ site
nodes) move from virtiofs bind mounts to named docker volumes
(scadabridge-<node>-data), seeded in place with both rigs stopped and
live-verified (site-a localDbReplicationConnected=true / backlog 0 over
the migrated files; env2 stable, 0 restarts). The feared inspectability
loss is moot — OrbStack exposes volumes at ~/OrbStack/docker/volumes/.
The rebuild surfaced latent env2 drift (pre-Secrets-0.6.2 image): env2
now carries the x-secrets-store-env posture + central data volumes.

Row 93's silent maintenance trap is now loud: SiteEventsSchemaCalibrationTests
pins the site_events columns/indexes the EventLogPurgeService size model is
calibrated against, failing with a pointer to the memo §4 recalibration on
any schema drift. Rows 92 (accepted by design) and 94 (standing tripwire)
annotated accordingly.

docker/README.md

@@ -97,30 +97,29 @@ docker/
 │   └── logs/
 ├── site-a-node-a/
 │   ├── appsettings.Site.json           # Site-A node A configuration
-│   ├── data/                           # SQLite databases (gitignored)
-│   └── logs/
+│   └── logs/                           # Serilog file output (gitignored)
 ├── site-a-node-b/
 │   ├── appsettings.Site.json
-│   ├── data/
 │   └── logs/
 ├── site-b-node-a/
 │   ├── appsettings.Site.json           # Site-B node A configuration
-│   ├── data/
 │   └── logs/
 ├── site-b-node-b/
 │   ├── appsettings.Site.json
-│   ├── data/
 │   └── logs/
 ├── site-c-node-a/
 │   ├── appsettings.Site.json           # Site-C node A configuration
-│   ├── data/
 │   └── logs/
 └── site-c-node-b/
     ├── appsettings.Site.json
-    ├── data/
     └── logs/
 ```
 
+SQLite databases live in **named docker volumes** (`scadabridge-<node>-data`, one per node —
+register row 79), not in the node directories; inspect them from the host (read-only) at
+`~/OrbStack/docker/volumes/<name>/`. Any `docker/<node>/data/` directory still on disk is a
+dormant pre-migration (2026-08-18) backup, no longer mounted.
+
 ## gRPC control-plane keys (dev)
 
 The site gRPC service (`SiteStreamService` on 8083 — live subscriptions, audit pull,
@@ -315,20 +314,27 @@ dotnet run --project src/ZB.MOM.WW.ScadaBridge.CLI -- \
 
 ### Clear Site Data
 
-Remove SQLite databases to reset site state (deployed configs, S&F buffers):
+Remove SQLite databases to reset site state (deployed configs, S&F buffers). Data lives in
+named docker volumes (`scadabridge-<node>-data`, register row 79 — no longer bind-mounted
+under `docker/<node>/data`), so empty the volume with a throwaway container while the pair
+is stopped:
 
 ```bash
 # Single site
-rm -rf docker/site-a-node-a/data docker/site-a-node-b/data
-docker restart scadabridge-site-a-a scadabridge-site-a-b
+docker compose -f docker/docker-compose.yml stop site-a-a site-a-b
+docker run --rm \
+    -v scadabridge-site-a-node-a-data:/a -v scadabridge-site-a-node-b-data:/b \
+    alpine sh -c 'rm -rf /a/* /b/*'
+docker compose -f docker/docker-compose.yml start site-a-a site-a-b
 
-# All sites
-rm -rf docker/site-*/data
-docker restart scadabridge-site-a-a scadabridge-site-a-b \
-    scadabridge-site-b-a scadabridge-site-b-b \
-    scadabridge-site-c-a scadabridge-site-c-b
+# All sites: repeat with the six scadabridge-site-*-data volumes, or teardown + volume rm
+# (see teardown.sh's hint) and redeploy.
 ```
 
+To inspect a node's live databases from the host, read them via OrbStack's volume
+exposure (read-only inspection — don't write through this path):
+`~/OrbStack/docker/volumes/scadabridge-site-a-node-a-data/site-localdb.db`.
+
 ### Rebuild Image From Scratch (no cache)
 
 ```bash