docs(secrets): review follow-ups — pre-Serilog window note, ThrowIfNull hygiene, honest site-purity scan bound

The expander comment now records that a SQL outage at central boot exits
pre-Serilog with a bare stderr trace (honest, restart-retryable, unenriched)
and why the role-reading predicate deliberately stays in Program.cs rather
than SecretsRegistration (that class refuses config-read roles by design).
EnsureCentralSharedStoreConnectionString gains the file's standard
ThrowIfNull. The site-purity scan's doc no longer overclaims: two
factory-lambda descriptors evade it individually; the pin holds because
three concrete-type registrations from the same call cannot.

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SecretsReplicationWiringTests.cs

@@ -79,9 +79,14 @@ public class SecretsReplicationWiringTests
             == "ZB.MOM.WW.Secrets.Replicator.SqlServer";
 
     /// <summary>
-    /// Any descriptor contributed by the SQL-Server replicator package, whatever its shape. The
-    /// package's factory-lambda registrations (its store, migrator, connection factory) carry the
-    /// concrete type as the SERVICE type, so checking both sides catches every registration form.
+    /// Any descriptor whose service OR implementation type lives in the SQL-Server replicator
+    /// assembly. Honest bound: the package also registers <c>ISecretStore</c>/<c>ISecretsStoreMigrator</c>
+    /// through factory lambdas whose service type is the Abstractions interface and whose
+    /// ImplementationType is null — those two descriptors would evade this scan in isolation. The
+    /// site-purity pin still holds because the same extension unconditionally registers three
+    /// concrete types from the target assembly first, which this scan does catch — so the package
+    /// cannot enter the container without tripping it, even though not every individual descriptor
+    /// it adds is individually detectable.
     /// </summary>
     private static bool IsFromSqlServerReplicatorPackage(ServiceDescriptor descriptor) =>
         descriptor.ServiceType.Assembly.GetName().Name == "ZB.MOM.WW.Secrets.Replicator.SqlServer"