feat(grpc): site-side ICentralTransport seam + gRPC transport (T1A.3)

Introduce ICentralTransport as the site->central choke point inside
SiteCommunicationActor. The seven site->central sends (notification submit/
status, audit + cached-telemetry ingest, reconcile, health, heartbeat) now
delegate to an injected transport instead of owning ClusterClient.Send inline.

- AkkaCentralTransport: verbatim extraction of today's ClusterClient.Send path,
  including the exact sender-forwarding that routes central's reply straight
  back to the waiting Ask. Default when no transport is injected -> behaviour
  unchanged, existing SiteCommunicationActorTests pass as-is.
- GrpcCentralTransport + CentralChannelProvider: dial CentralControlService with
  sticky failover + background failback (1s-doubling-cap-60s), PSK +
  x-scadabridge-site via ControlPlaneCredentials, per-call deadlines mirroring
  today's Ask timeouts. Cross-node retry ONLY on provably-unsent
  connect failures; never on DeadlineExceeded. Heartbeat stays fire-and-forget.
- StaticSitePskProvider: site's single own-key provider (fail-closed).
- CommunicationOptions: CentralTransport flag (default Akka) + CentralGrpcEndpoints
  (validator: required when transport=Grpc). Host selects the impl; the
  ClusterClient is created only on the Akka path.

Tests: actor-with-fake-transport (7 delegations + fault routing + heartbeat
no-fault), AkkaCentralTransport sender-forwarding, GrpcCentralTransport over
in-process TestServer (failover flip, sticky, failback, PSK+header, deadline,
no-retry-on-deadline), validator. Communication.Tests 371 green, Host.Tests 391
green; the three above-seam suites pass unmodified.

src/ZB.MOM.WW.ScadaBridge.Host/Actors/AkkaHostedService.cs

@@ -8,6 +8,7 @@ using Microsoft.Extensions.Options;
 using ZB.MOM.WW.ScadaBridge.ClusterInfrastructure;
 using ZB.MOM.WW.ScadaBridge.Communication;
 using ZB.MOM.WW.ScadaBridge.Communication.Actors;
+using ZB.MOM.WW.ScadaBridge.Communication.Grpc;
 using ZB.MOM.WW.ScadaBridge.Host.Actors;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Actors;
@@ -832,13 +833,45 @@ akka {{
             _logger, role: siteRole);
         var dmProxy = dm.Proxy;
 
+        // Select the site→central transport behind the coexistence flag (default Akka
+        // ClusterClient). When gRPC is chosen the site dials CentralControlService directly with
+        // a sticky-failover channel pair, presenting its own preshared key; the ClusterClient
+        // below is then not created at all.
+        ICentralTransport? centralTransport = null;
+        if (_communicationOptions.CentralTransport == CentralTransportMode.Grpc)
+        {
+            var loggerFactory = _serviceProvider.GetRequiredService<ILoggerFactory>();
+            var channelProvider = new CentralChannelProvider(
+                _communicationOptions.CentralGrpcEndpoints,
+                new StaticSitePskProvider(_communicationOptions.GrpcPsk),
+                _nodeOptions.SiteId!,
+                _communicationOptions,
+                loggerFactory.CreateLogger<CentralChannelProvider>());
+            _trackedDisposables.Add(channelProvider);
+            centralTransport = new GrpcCentralTransport(
+                channelProvider,
+                _communicationOptions,
+                loggerFactory.CreateLogger<GrpcCentralTransport>());
+            _logger.LogInformation(
+                "Site→central transport: gRPC to {Count} central endpoint(s) for site {SiteId}",
+                _communicationOptions.CentralGrpcEndpoints.Count, _nodeOptions.SiteId);
+        }
+        else
+        {
+            _logger.LogInformation(
+                "Site→central transport: Akka ClusterClient (default) for site {SiteId}",
+                _nodeOptions.SiteId);
+        }
+
         // Create SiteCommunicationActor for receiving messages from central
         var siteCommActor = _actorSystem.ActorOf(
             Props.Create(() => new SiteCommunicationActor(
                 _nodeOptions.SiteId!,
                 _communicationOptions,
                 dmProxy,
-                activeNodeCheck)),
+                activeNodeCheck,
+                null,
+                centralTransport)),
             "site-communication");
 
         // Register local handlers with SiteCommunicationActor
@@ -957,8 +990,12 @@ akka {{
             "Site actors registered. DeploymentManager singleton scoped to role={SiteRole}, SiteCommunicationActor created.",
             siteRole);
 
-        // Create ClusterClient to central if contact points are configured
-        if (_communicationOptions.CentralContactPoints.Count > 0)
+        // Create ClusterClient to central if contact points are configured — but only on the Akka
+        // transport. On the gRPC transport the SiteCommunicationActor already holds a
+        // GrpcCentralTransport and never receives RegisterCentralClient, so a ClusterClient here
+        // would be dead weight (and keep an unwanted cross-cluster Akka association alive).
+        if (_communicationOptions.CentralTransport == CentralTransportMode.Akka
+            && _communicationOptions.CentralContactPoints.Count > 0)
         {
             var contacts = _communicationOptions.CentralContactPoints
                 .Select(cp => ActorPath.Parse($"{cp}/system/receptionist"))