perf(sitelog): sampled per-run events; interval run summaries; site_events replication policy pinned

Implements WP3.2 stage (b) per docs/plans/2026-08-15-site-events-policy-design.md.

- Per-run instance-script Started/Completed Info site events are now off by
  default (SiteRuntimeOptions.PerRunScriptEvents=false) instead of firing on
  every run, closing the dominant site_events writer. Gated at the ScriptRunLauncher
  call sites (moved there from ScriptExecutionActor by WP3.1). Error-level events
  (timeout/failure/stuck-watchdog/recursion-limit) remain unconditional.
- ScriptRunSummaryRecorder accumulates per-(instance, script) run counters and a
  new site-only ScriptRunSummaryFlushService emits one aggregate "script" Info
  site event per ScriptRunSummaryIntervalSeconds (default 300s), top-50-script
  breakdown with an "others" rollup, zero-activity intervals emit nothing.
- Per-script opt-in via PerRunScriptEventScripts ("Instance/Script" exact or
  "Instance/*" wildcard), matched by the new pure ScriptRunEventPolicy. All three
  options are read from IOptionsMonitor<SiteRuntimeOptions> per run, so the
  policy is hot-togglable without a restart.
- Fixed the stale "event log is not replicated" comment at AkkaHostedService.cs
  (~905): site_events IS registered in SiteLocalDbSetup.ReplicatedTables — the
  singleton is what makes queries always hit the actively-written copy;
  replication is what gives the singleton history to read after a failover
  (memo Decision (b)). site_events replication itself is unchanged (still
  registered) and already pinned by
  tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SiteLocalDbCdcRegistrationTests.cs.
- Updated Component-SiteEventLogging.md (Volume Policy section, corrected
  Storage/replication rationale) and Component-SiteRuntime.md (Script Run
  Launch + Error Handling sections).

src/ZB.MOM.WW.ScadaBridge.Host/Actors/AkkaHostedService.cs

@@ -902,10 +902,15 @@ akka {{
         // Register local handlers with SiteCommunicationActor
         siteCommActor.Tell(new RegisterLocalHandler(LocalHandlerType.Artifacts, dmProxy));
 
-        // Event log handler — cluster singleton so queries always reach the
-        // active node. The event log is node-local SQLite and is not
-        // replicated; only the active node records events. A per-node handler
-        // would let a central query land on the standby and find nothing.
+        // Event log handler — cluster singleton so queries always reach the copy that is
+        // ACTIVELY BEING WRITTEN: the site_events table IS replicated (LocalDb Phase 1,
+        // SiteLocalDbSetup.ReplicatedTables), but replication alone would not save a
+        // per-node handler — central queries route through SiteCommandDispatcher to
+        // whichever node answers, and a standby's replica sits idle until failover. The
+        // singleton is what guarantees queries always read the actively-written copy;
+        // replication is what gives the singleton HISTORY to read after it moves —
+        // without it, a failover would restart the event log empty at exactly the moment
+        // an operator is investigating an incident (WP3.2 design memo, Decision (b)).
         var eventLogQueryService = _serviceProvider.GetService<SiteEventLogging.IEventLogQueryService>();
         if (eventLogQueryService != null)
         {