chore(audit): ScadaBridge C7 — perf re-baseline + CollapseAuditLogToCanonical projection test + index-test fix + dead-cref cleanup (Task 2.5)

Perf re-baseline (HotPathLatencyTests): empirical p95 on Apple M-series Release
build: 4KB DetailsJson slow path ≈14 µs, small-DetailsJson no-redactors ≈2 µs,
true no-op fast path ≈0 µs. Thresholds updated: 200 µs / 30 µs / 5 µs (≈15×
headroom for contested CI runners). Old thresholds (50 µs / 10 µs) were set for
the pre-C3 typed-field path; canonical JSON parse+rewrite is empirically faster.
Adds a third test (Filter_Apply_NoDetailsJson_FastPath) that asserts same-instance
return on the DetailsJson-null + within-cap fast path. Env-var overrides retained.

CollapseAuditLogToCanonicalMigrationTests (new): three MSSQL-gated [SkippableFact]
tests verifying Action/Category/Outcome projection, NULL Actor, DetailsJson codec
round-trip, and all six persisted computed columns (Kind/Status/SourceSiteId/
ExecutionId/ParentExecutionId) for ApiOutbound, InboundAuthFailure, and Failed-
status rows.

AddAuditLogTableMigrationTests: rename CreatesFiveNamedIndexes →
CreatesNineNamedIndexes; expand coverage from 5 original indexes to all 9 named
non-clustered indexes present after CollapseAuditLogToCanonical (adds
IX_AuditLog_Execution, IX_AuditLog_ParentExecution, IX_AuditLog_Node_Occurred,
UX_AuditLog_EventId).

Dead-cref cleanup: zero references to the deleted IAuditPayloadFilter /
DefaultAuditPayloadFilter / SafeDefaultAuditPayloadFilter types remain in any
.cs file (source or test). 26 occurrences across 13 files replaced with correct
references to IAuditRedactor / ScadaBridgeAuditRedactor / SafeDefaultAuditRedactor
or reworded as plain prose.

Residual sweep: no unused transitional code found beyond the acknowledged
"C3 transitional shim" comments on IngestedAtUtc stamping (active code, not dead).

src/ZB.MOM.WW.ScadaBridge.AuditLog/ServiceCollectionExtensions.cs

@@ -72,14 +72,11 @@ public static class ServiceCollectionExtensions
         // validator (a strict improvement over the previous AddSingleton).
         services.AddValidatedOptions<AuditLogOptions, AuditLogOptionsValidator>(config, ConfigSectionName);
 
-        // C3 (Task 2.5): the canonical IAuditRedactor replaces the legacy
-        // IAuditPayloadFilter in the writer pipeline. ScadaBridgeAuditRedactor
-        // is the port of DefaultAuditPayloadFilter onto the canonical record +
-        // its DetailsJson payload bag — same truncation + header / body /
-        // SQL-parameter redaction, applied between event construction and
-        // persistence. Singleton — stateless; the IOptionsMonitor dependency
-        // picks up hot reloads on its own. The old IAuditPayloadFilter classes
-        // are retained but no longer wired into any pipeline (C7 deletes them).
+        // C3 (Task 2.5): the canonical IAuditRedactor is wired as
+        // ScadaBridgeAuditRedactor — same truncation + header / body /
+        // SQL-parameter redaction as the original pipeline, applied between
+        // event construction and persistence. Singleton — stateless; the
+        // IOptionsMonitor dependency picks up hot reloads on its own.
         services.AddSingleton<IAuditRedactor, ScadaBridgeAuditRedactor>();
 
         // M5 Bundle B: per-stage redactor-failure counter. NoOp default;
@@ -234,7 +231,7 @@ public static class ServiceCollectionExtensions
     /// real <see cref="HealthMetricsAuditWriteFailureCounter"/> /
     /// <see cref="HealthMetricsAuditRedactionFailureCounter"/> bridges so the
     /// FallbackAuditWriter primary-failure counter AND the
-    /// DefaultAuditPayloadFilter redactor-failure counter both surface in the
+    /// <see cref="ScadaBridgeAuditRedactor"/> redactor-failure counter both surface in the
     /// site health report payload as
     /// <c>SiteHealthReport.SiteAuditWriteFailures</c> +
     /// <c>SiteHealthReport.AuditRedactionFailure</c>.