feat(sitecallaudit): PullSiteCalls reconciliation plumbing (store read + RPC + site handler + central client)

Site Call Audit (#22): build the documented periodic reconciliation PULL
self-heal path for the eventually-consistent central SiteCalls mirror, as a
dedicated PullSiteCalls gRPC RPC kept separate from the audit pull. This is the
pull PLUMBING only; the central reconciliation tick is a separate follow-up.

- IOperationTrackingStore.ReadChangedSinceAsync(sinceUtc, batchSize): inclusive
  UpdatedAtUtc cursor, oldest-first, batch-capped; SQLite impl projects tracking
  rows onto SiteCallOperational (Kind->Channel, TargetSummary->Target, SourceSite
  left empty - the store has no site-id column).
- sitestream.proto: rpc PullSiteCalls + PullSiteCallsRequest/Response, mirroring
  PullAuditEvents; regenerated checked-in SiteStreamGrpc/*.cs.
- SiteCallDtoMapper.ToDto(SiteCallOperational): inverse of FromDto for the handler.
- SiteStreamGrpcServer.PullSiteCalls handler + SetOperationTrackingStore seam;
  Host wires the seam alongside SetSiteAuditQueue (site roles only).
- Central IPullSiteCallsClient + GrpcPullSiteCallsClient (home: AuditLog/Central to
  reuse ISiteEnumerator; SiteCallAudit does not reference AuditLog). Re-stamps
  SourceSite from the dialed siteId; no-throw on tolerable transport faults;
  SpecifyKind (not ToUniversalTime) cursor handling. Central-only DI registration.

Tests: ReadChangedSinceAsync (4), PullSiteCalls handler (6), GrpcPullSiteCallsClient
(8). Full solution build 0 warnings/0 errors (TreatWarningsAsErrors).

src/ZB.MOM.WW.ScadaBridge.Communication/Protos/sitestream.proto

@@ -10,6 +10,7 @@ service SiteStreamService {
   rpc IngestAuditEvents(AuditEventBatch) returns (IngestAck);
   rpc IngestCachedTelemetry(CachedTelemetryBatch) returns (IngestAck);
   rpc PullAuditEvents(PullAuditEventsRequest) returns (PullAuditEventsResponse);
+  rpc PullSiteCalls(PullSiteCallsRequest) returns (PullSiteCallsResponse);
 }
 
 message InstanceStreamRequest {
@@ -157,3 +158,20 @@ message PullAuditEventsResponse {
   repeated AuditEventDto events = 1;
   bool more_available = 2;
 }
+
+// Site Call Audit (#22) reconciliation pull: central→site request for any
+// site-local operation-tracking rows whose UpdatedAtUtc >= since_utc — the
+// self-heal feed that backfills the eventually-consistent central SiteCalls
+// mirror when best-effort push telemetry is lost. Mirrors PullAuditEvents
+// but is a SEPARATE RPC (the tracking store is the operational source of
+// truth, distinct from the site audit queue). more_available signals
+// batch_size was saturated so the caller advances since_utc and pulls again.
+message PullSiteCallsRequest {
+  google.protobuf.Timestamp since_utc = 1;
+  int32 batch_size = 2;
+}
+
+message PullSiteCallsResponse {
+  repeated SiteCallOperationalDto operationals = 1;
+  bool more_available = 2;
+}