feat(sitecallaudit): PullSiteCalls reconciliation plumbing (store read + RPC + site handler + central client)

Site Call Audit (#22): build the documented periodic reconciliation PULL
self-heal path for the eventually-consistent central SiteCalls mirror, as a
dedicated PullSiteCalls gRPC RPC kept separate from the audit pull. This is the
pull PLUMBING only; the central reconciliation tick is a separate follow-up.

- IOperationTrackingStore.ReadChangedSinceAsync(sinceUtc, batchSize): inclusive
  UpdatedAtUtc cursor, oldest-first, batch-capped; SQLite impl projects tracking
  rows onto SiteCallOperational (Kind->Channel, TargetSummary->Target, SourceSite
  left empty - the store has no site-id column).
- sitestream.proto: rpc PullSiteCalls + PullSiteCallsRequest/Response, mirroring
  PullAuditEvents; regenerated checked-in SiteStreamGrpc/*.cs.
- SiteCallDtoMapper.ToDto(SiteCallOperational): inverse of FromDto for the handler.
- SiteStreamGrpcServer.PullSiteCalls handler + SetOperationTrackingStore seam;
  Host wires the seam alongside SetSiteAuditQueue (site roles only).
- Central IPullSiteCallsClient + GrpcPullSiteCallsClient (home: AuditLog/Central to
  reuse ISiteEnumerator; SiteCallAudit does not reference AuditLog). Re-stamps
  SourceSite from the dialed siteId; no-throw on tolerable transport faults;
  SpecifyKind (not ToUniversalTime) cursor handling. Central-only DI registration.

Tests: ReadChangedSinceAsync (4), PullSiteCalls handler (6), GrpcPullSiteCallsClient
(8). Full solution build 0 warnings/0 errors (TreatWarningsAsErrors).

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Tracking/OperationTrackingStore.cs

@@ -360,6 +360,76 @@ public class OperationTrackingStore : IOperationTrackingStore, IAsyncDisposable,
         }
     }
 
+    /// <inheritdoc/>
+    public async Task<IReadOnlyList<SiteCallOperational>> ReadChangedSinceAsync(
+        DateTime sinceUtc,
+        int batchSize,
+        CancellationToken ct = default)
+    {
+        ObjectDisposedException.ThrowIf(Volatile.Read(ref _disposeState) != 0, this);
+
+        // SiteRuntime-024: like GetStatusAsync, the reconciliation pull opens a
+        // fresh, ungated read connection so a long-running write never blocks
+        // central's PullSiteCalls. The query is a bounded, ordered scan over the
+        // (Status, UpdatedAtUtc) index range — UpdatedAtUtc is the cursor.
+        await using var readConnection = new SqliteConnection(_connectionString);
+        await readConnection.OpenAsync(ct).ConfigureAwait(false);
+
+        await using var cmd = readConnection.CreateCommand();
+        // Inclusive lower bound on UpdatedAtUtc (>=) so a caller resuming from
+        // the last returned timestamp does not skip a row sharing that instant;
+        // central ingest is insert-if-not-exists + upsert-on-newer, so the
+        // boundary row re-read is a no-op. ORDER BY ... ASC + LIMIT yields the
+        // OLDEST matching rows so the cursor advances monotonically.
+        cmd.CommandText = """
+            SELECT TrackedOperationId, Kind, TargetSummary, Status,
+                   RetryCount, LastError, HttpStatus,
+                   CreatedAtUtc, UpdatedAtUtc, TerminalAtUtc, SourceNode
+            FROM   OperationTracking
+            WHERE  UpdatedAtUtc >= $since
+            ORDER  BY UpdatedAtUtc ASC
+            LIMIT  $batchSize;
+            """;
+        cmd.Parameters.AddWithValue(
+            "$since",
+            sinceUtc.ToString("o", CultureInfo.InvariantCulture));
+        cmd.Parameters.AddWithValue("$batchSize", batchSize);
+
+        var rows = new List<SiteCallOperational>();
+        await using var reader = await cmd.ExecuteReaderAsync(ct).ConfigureAwait(false);
+        while (await reader.ReadAsync(ct).ConfigureAwait(false))
+        {
+            var kind = reader.GetString(1);
+            rows.Add(new SiteCallOperational(
+                TrackedOperationId: TrackedOperationId.Parse(reader.GetString(0)),
+                Channel: KindToChannel(kind),
+                Target: reader.IsDBNull(2) ? string.Empty : reader.GetString(2),
+                // The site id is not a tracking-store column; the central client
+                // re-stamps SourceSite from the siteId it dialed.
+                SourceSite: string.Empty,
+                SourceNode: reader.IsDBNull(10) ? null : reader.GetString(10),
+                Status: reader.GetString(3),
+                RetryCount: reader.GetInt32(4),
+                LastError: reader.IsDBNull(5) ? null : reader.GetString(5),
+                HttpStatus: reader.IsDBNull(6) ? null : reader.GetInt32(6),
+                CreatedAtUtc: ParseUtc(reader.GetString(7)),
+                UpdatedAtUtc: ParseUtc(reader.GetString(8)),
+                TerminalAtUtc: reader.IsDBNull(9) ? null : ParseUtc(reader.GetString(9))));
+        }
+
+        return rows;
+    }
+
+    // Cached-call Kind → SiteCalls Channel. Only ApiCallCached / DbWriteCached
+    // ever reach the tracking store (RecordEnqueueAsync is the cached-call
+    // entry point); DbWriteCached maps to DbOutbound, everything else to the
+    // ApiOutbound default. Mirrors CachedCallLifecycleBridge's channel handling.
+    private static string KindToChannel(string kind) => kind switch
+    {
+        nameof(Commons.Types.Enums.AuditKind.DbWriteCached) => nameof(Commons.Types.Enums.AuditChannel.DbOutbound),
+        _ => nameof(Commons.Types.Enums.AuditChannel.ApiOutbound),
+    };
+
     private static DateTime ParseUtc(string raw)
     {
         return DateTime.Parse(