fix(site-secrets): keep a live node's mirror-status row from losing a race with the peer's prune

Rig finding on the upgrade restart: both nodes' rows were older than the stale threshold
(the old build never refreshed them), so node-a's reporter pruned node-b's row while node-b
wrote a fresh one, and the replicated delete won. The reporter now prunes nothing during its
first refresh interval after start-up, and each mirror pass re-writes its own row if it no
longer holds what the mirror last wrote.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Persistence/SiteStorageService.cs

@@ -1006,6 +1006,26 @@ public class SiteStorageService
         return results;
     }
 
+    /// <summary>
+    /// Returns the raw <c>checked_at</c> of <paramref name="nodeName"/>'s
+    /// <c>secret_mirror_status</c> row, or <see langword="null"/> when the node has no row — a
+    /// cheap local read the mirror uses to notice its row was deleted by the peer's prune.
+    /// </summary>
+    /// <param name="nodeName">The row key.</param>
+    /// <returns>The stored <c>checked_at</c> text, or <see langword="null"/>.</returns>
+    public async Task<string?> GetSecretMirrorStatusCheckedAtAsync(string nodeName)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(nodeName);
+
+        await using var connection = OpenConnection();
+
+        await using var command = connection.CreateCommand();
+        command.CommandText = "SELECT checked_at FROM secret_mirror_status WHERE node_name = @nodeName";
+        command.Parameters.AddWithValue("@nodeName", nodeName);
+
+        return await command.ExecuteScalarAsync() as string;
+    }
+
     /// <summary>
     /// Deletes <paramref name="nodeName"/>'s <c>secret_mirror_status</c> row, but only while it
     /// still carries <paramref name="checkedAtUtc"/> — so a row the node re-wrote after the caller