fix(site-secrets): prune secret_mirror_status rows of decommissioned or renamed nodes

Each node now re-writes its mirror-status row every SecretMirrorStatusRefreshInterval
(10 min) as a heartbeat; SecretMirrorStatusReporter leaves off the health report and
deletes any row not refreshed for SecretMirrorStatusStaleAfter (1 h, validated >= 2x the
refresh). The delete is conditional on the checked_at it read, so a node that came back
keeps its fresh row; a returning node re-writes its row on its first pass.

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/SiteRuntimeOptionsValidatorTests.cs

@@ -243,4 +243,26 @@ public class SiteRuntimeOptionsValidatorTests
         Assert.True(result.Failed);
         Assert.Contains("ScriptFileAccess:MaxFileBytes", result.FailureMessage);
     }
+
+    [Fact]
+    public void ZeroSecretMirrorStatusRefreshInterval_IsRejected()
+    {
+        var result = Validate(new SiteRuntimeOptions { SecretMirrorStatusRefreshInterval = TimeSpan.Zero });
+
+        Assert.True(result.Failed);
+        Assert.Contains("SecretMirrorStatusRefreshInterval", result.FailureMessage);
+    }
+
+    [Fact]
+    public void SecretMirrorStatusStaleAfter_UnderTwoRefreshes_IsRejected()
+    {
+        var result = Validate(new SiteRuntimeOptions
+        {
+            SecretMirrorStatusRefreshInterval = TimeSpan.FromMinutes(10),
+            SecretMirrorStatusStaleAfter = TimeSpan.FromMinutes(15),
+        });
+
+        Assert.True(result.Failed);
+        Assert.Contains("SecretMirrorStatusStaleAfter", result.FailureMessage);
+    }
 }