feat(transport): production-boundary signing advisory, secret-key proof, runbook (#110)

Owner decisions on #110: one signing key per environment; TrustedKeys stay hand-edited;
Signing:ProductionBoundary (new, default off) logs a startup warning and reports a Degraded
bundle-signing-policy /health/ready entry while RequireSignedBundles is off; the private key
is read via ${secret:} (proved end to end, never logged); cluster pull decided not to be
built; differential deletions stay deferred. Adds docs/operations/bundle-signing-runbook.md.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -568,6 +568,12 @@ try
                 "required-singletons",
                 failureStatus: null,
                 tags: new[] { ZbHealthTags.Ready })
+            // ScadaBridge#110: Degraded (HTTP 200) while a Transport:Signing:ProductionBoundary
+            // cluster still accepts unsigned bundles.
+            .AddTypeActivatedCheck<BundleSigningPolicyHealthCheck>(
+                "bundle-signing-policy",
+                failureStatus: null,
+                tags: new[] { ZbHealthTags.Ready })
             // Oldest-Up-member check (review 01 [High]), unscoped: every central member competes for
             // the one active slot. Since ZB.MOM.WW.Health 0.3.0 this IS the shared check — it selects
             // by age, so the host-local OldestNodeActiveHealthCheck that existed only to avoid the old