refactor(host): remove legacy site-psk-invalidation topic (#105)

Removes the #96 compatibility path that the unified central-cache-invalidation
topic (#100 item 3, 153609ef; compat 3a31dd2d) carried for one release:
- CentralCacheInvalidationBus no longer publishes a bare SitePskInvalidated
  on site-psk-invalidation; LegacySitePskTopic constant deleted.
- CentralCacheInvalidationSubscriber no longer subscribes to that topic or
  handles a bare SitePskInvalidated; it applies envelopes only.
central-cache-invalidation behaviour is unchanged (one envelope per
invalidation, origin filtering, per-handler fault isolation).

Gate met: 8e32f353 (carries 153609ef and 3a31dd2d) runs on every central
node - DEV vd03 (record 581e25ca) and QA vq03/vq04 (record 8ba5d5d7).

Mixed-version / rolling-upgrade constraint: a central node built before
153609ef listens only on site-psk-invalidation and no longer receives PSK
invalidations from a newer peer (only its TTL and the site-rejection refresh
bound the staleness). Mixed pairs across that boundary are no longer
supported; central pairs are stopped and started together anyway.
Documented in Component-Host.md and Component-Communication.md.

Tests: the legacy publish/subscribe tests are replaced by
PskRotation_OnOneNode_ReachesThePeersCaches_ThroughTheUnifiedTopic (node A
publishes, node B's PSK cache and secret-resolver cache are invalidated, and
nothing else is published) and a bare-message-ignored test with an envelope
positive control. The two-node cluster test now asserts the PSK invalidation
arrives exactly once and the publisher applies nothing.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/Cluster/CentralCacheInvalidationTwoNodeTests.cs

@@ -76,12 +76,13 @@ public class CentralCacheInvalidationTwoNodeTests
         Assert.Contains(applied, i => i is RoleMappingsInvalidated);
         Assert.Contains(new ExternalDefinitionsInvalidated(), applied);
         Assert.Contains(new InboundApiMethodInvalidated("MesMoveIn"), applied);
-        // The PSK invalidation arrives twice during the migration window (shared + legacy topic).
-        Assert.Contains(new SitePskInvalidated("site-a"), applied);
-
-        // The publisher skips its own envelopes; only the bare legacy PSK message (no origin)
-        // comes back to it, which is the pre-existing #96 behaviour and idempotent.
+        // One topic only since ScadaBridge#105: the PSK invalidation arrives exactly once.
         await Task.Delay(500);
-        Assert.All(a.Handler.Applied, i => Assert.IsType<SitePskInvalidated>(i));
+        Assert.Single(b.Handler.Applied, i => i is SitePskInvalidated);
+        Assert.Contains(new SitePskInvalidated("site-a"), b.Handler.Applied);
+
+        // The publisher skips its own envelopes, and with the legacy bare PSK topic gone nothing
+        // comes back to it at all.
+        Assert.Empty(a.Handler.Applied);
     }
 }