docs(secrets): review follow-ups — pre-Serilog window note, ThrowIfNull hygiene, honest site-purity scan bound

The expander comment now records that a SQL outage at central boot exits
pre-Serilog with a bare stderr trace (honest, restart-retryable, unenriched)
and why the role-reading predicate deliberately stays in Program.cs rather
than SecretsRegistration (that class refuses config-read roles by design).
EnsureCentralSharedStoreConnectionString gains the file's standard
ThrowIfNull. The site-purity scan's doc no longer overclaims: two
factory-lambda descriptors evade it individually; the pin holds because
three concrete-type registrations from the same call cannot.

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

src/ZB.MOM.WW.ScadaBridge.Host/SecretsRegistration.cs

@@ -199,6 +199,8 @@ public static class SecretsRegistration
     /// </exception>
     internal static string EnsureCentralSharedStoreConnectionString(IConfiguration config)
     {
+        ArgumentNullException.ThrowIfNull(config);
+
         var hubConnectionString = config[HubConnectionStringKey];
 
         if (string.IsNullOrWhiteSpace(hubConnectionString))