docs(secrets): review follow-ups — pre-Serilog window note, ThrowIfNull hygiene, honest site-purity scan bound

The expander comment now records that a SQL outage at central boot exits
pre-Serilog with a bare stderr trace (honest, restart-retryable, unenriched)
and why the role-reading predicate deliberately stays in Program.cs rather
than SecretsRegistration (that class refuses config-read roles by design).
EnsureCentralSharedStoreConnectionString gains the file's standard
ThrowIfNull. The site-purity scan's doc no longer overclaims: two
factory-lambda descriptors evade it individually; the pin holds because
three concrete-type registrations from the same call cannot.

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -64,6 +64,15 @@ var configuration = new ConfigurationBuilder()
 // EnsureCentralSharedStoreConnectionString check AddScadaBridgeSecrets runs — this is the
 // earliest code that would otherwise hand the bad value to SqlConnection, whose generic
 // "initialization string" format error would bury the designed message.
+//
+// Two consequences worth knowing. This block runs BEFORE Serilog exists and outside the
+// try/catch below, so a SQL Server outage at central boot exits with a bare stderr stack
+// trace, no structured log — honest and container-restart-retryable, just unenriched; the
+// SQLite path had the same window but its only failure mode was a local file. And the
+// role check is deliberately NOT folded into SecretsRegistration: that class refuses to
+// read the node role from configuration (a config-read role could silently turn a site
+// into a hub — see SecretsNodeRole), while Program.cs must read it to branch the whole
+// composition anyway, so the config read stays here at the composition root.
 var expanderUsesSharedSqlStore =
     string.Equals(
         configuration["ScadaBridge:Node:Role"], "Central", StringComparison.OrdinalIgnoreCase)

src/ZB.MOM.WW.ScadaBridge.Host/SecretsRegistration.cs

@@ -199,6 +199,8 @@ public static class SecretsRegistration
     /// </exception>
     internal static string EnsureCentralSharedStoreConnectionString(IConfiguration config)
     {
+        ArgumentNullException.ThrowIfNull(config);
+
         var hubConnectionString = config[HubConnectionStringKey];
 
         if (string.IsNullOrWhiteSpace(hubConnectionString))