fix(site-secrets): ship an empty Secrets list, not null, when a site references no secrets

The site applies DeployArtifactsCommand.Secrets as the full set (rows absent from it are
soft-removed and DeployedSecretsMirror deletes them on both nodes), while null means
'central shipped no secrets' and touches nothing. The command builder shipped null for a
site with no references, so dropping the LAST secret: reference never removed the secret
from either site node. Found by the Task 13 live gate (check 5: site-a-a and site-a-b
both still held sb-gate-mxgw r1, deployed_secrets.is_removed=0 after the removal deploy).

Central now always ships a list. Old sites ignore proto field 9; the artifact hash is
unchanged (empty and null hash identically); SecretsDeployed stays null and no
DeploySiteSecrets audit row is written when nothing shipped. Regression test
NoSecretReferences_ShipsEmptySecretsList_SoTheSiteRemovesPreviouslyDeployedOnes (red
before, green after). Spec notes in Component-DeploymentManager/SiteRuntime + the design
doc's as-built section.

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/ArtifactDeploymentService.cs

@@ -182,7 +182,15 @@ public class ArtifactDeploymentService
             // SMTP config (incl. credentials) is central-only — never shipped to sites.
             SmtpConfigurations: null,
             DateTimeOffset.UtcNow,
-            Secrets: collected.Secrets.Count > 0 ? collected.Secrets : null,
+            // ALWAYS a list — never null — even when the site references no secrets. The site
+            // applies Secrets as the FULL set (every deployed_secrets row absent from it is
+            // marked removed and the mirror deletes it), and a null Secrets means "central did
+            // not ship secrets at all" (the pre-feature/old-central contract), which touches
+            // nothing. Shipping null here when the LAST reference is dropped therefore left the
+            // secret live on both site nodes forever (Task 13 live gate, check 5). An empty
+            // list costs an old site nothing (it ignores proto field 9), and the hash is
+            // unaffected: the hash service folds an empty and a null list identically.
+            Secrets: collected.Secrets,
             MissingSecrets: collected.Missing.Count > 0 ? collected.Missing.Select(m => m.Name).ToList() : null);
 
         return (command, collected.Missing);