chore(docker): seed script for a deployable live-data probe instance on the rig

Deferred-work register row 48. The rig had no deployable instance — all seven
soak-* rows fail pre-deployment validation (their bound data connections no longer
exist on the sites) — so debug snapshot returned instanceNotFound, no gRPC site
stream was ever opened, and the R2 batching histogram
scadabridge.site.stream.batch_size had nothing to record. Any live probe of the
data or streaming path was unverifiable.

seed-live-probe.sh rebuilds the minimum working set via the CLI only (no DB edits):
RigProbe template (Spike <- ns=3;s=SpikeData, RandomInt <- ns=3;s=RandomSignedInt32,
both ~1 Hz; Heartbeat static attribute + a trust-clean 5s interval script) and a
deployed rig-probe-1 on site-a against connection 1.

Records the two traps that cost time here:
- The custom tags in infra/opcua/nodes.json (Motor.*, Tank.*, Valve.*,
  TestChildObject.*) are DECLARED but not simulated by opc-plc — they read 0/false/
  epoch forever, so binding to them yields a Connected, Good-quality connection with
  zero event traffic. Only the built-in nodes move.
- scadabridge_site_connection_up counts open central->site gRPC SUBSCRIBER STREAMS,
  not OPC UA data connections. It reads 0 on a healthy site with no subscriber, which
  is how row 48 read it as a data-connection fault. Data-connection health lives in
  the health report's dataConnectionEndpoints / dataConnectionTagQuality.

docker/README.md

@@ -87,6 +87,7 @@ docker/
 ├── build.sh                            # Build Docker image
 ├── deploy.sh                           # Build + deploy all containers
 ├── seed-sites.sh                       # Create test sites with Akka + gRPC addresses
+├── seed-live-probe.sh                  # Seed one deployable live-data instance on site-a (stream traffic)
 ├── teardown.sh                         # Stop and remove containers
 ├── central-node-a/
 │   ├── appsettings.Central.json        # Central node A configuration
@@ -160,6 +161,41 @@ docker/deploy.sh
 
 # 3. Seed test sites (first-time only, after cluster is healthy)
 docker/seed-sites.sh
+
+# 4. Seed one deployable live-data instance on site-a, so the rig has real
+#    stream traffic for live probes (see "Live-data probe instance" below)
+docker/seed-live-probe.sh
+```
+
+### Live-data probe instance
+
+`seed-live-probe.sh` creates the minimum working set the rig needs for any live probe
+of the data or streaming path: a `RigProbe` template with two attributes bound to
+**self-changing** opc-plc nodes (`ns=3;s=SpikeData`, `ns=3;s=RandomSignedInt32`, both
+~1 Hz) plus a 5 s heartbeat script, and a deployed `rig-probe-1` instance on site-a.
+
+Two traps it exists to avoid:
+
+- **The custom tags in `infra/opcua/nodes.json` are declared but not simulated.**
+  `Motor.*`, `Tank.*`, `Valve.*`, `TestChildObject.*` read 0 / false / epoch forever.
+  Binding to them gives a `Connected` data connection with `Good` quality and *zero*
+  event traffic, which looks healthy and probes nothing. Use the built-in simulated
+  nodes (`SpikeData`, `RandomSignedInt32`, `StepUp`, `FastUInt1..5`, `SlowUInt1..5`).
+- **`scadabridge_site_connection_up` does not mean what its name suggests.** It counts
+  open central→site gRPC *subscriber streams*, not OPC UA data connections, so it sits
+  at 0 on a perfectly healthy site with nobody watching. For data-connection health read
+  `dataConnectionEndpoints` / `dataConnectionTagQuality` off `scadabridge health site`.
+
+Verify (metrics are on container port 8084; the containers ship no curl/wget):
+
+```bash
+scadabridge debug snapshot --id <instance-id>
+scadabridge health site --identifier site-a
+scadabridge debug stream --id <instance-id>   # open a stream, then in another shell:
+
+docker exec scadabridge-site-a-a bash -c \
+  'exec 3<>/dev/tcp/localhost/8084 && printf "GET /metrics HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3 && cat <&3' \
+  | grep -E 'site_connection_up|stream_batch_size'
 ```
 
 ### After Code Changes