fix(audit-log): retention loop absorbs shutdown cancellation instead of faulting host StopAsync (plan R2-04 T12)

src/ZB.MOM.WW.ScadaBridge.AuditLog/Site/SiteAuditRetentionService.cs

@@ -61,32 +61,42 @@ public sealed class SiteAuditRetentionService : IHostedService, IDisposable
 
     private async Task RunLoopAsync(CancellationToken ct)
     {
-        // InitialDelay before the first purge — short so a daily-recycled node
-        // still purges soon after start rather than waiting a full interval it may
-        // never reach.
         try
         {
-            await Task.Delay(_options.InitialDelay, ct).ConfigureAwait(false);
-        }
-        catch (OperationCanceledException)
-        {
-            return;
-        }
-
-        await SafePurgeAsync(ct).ConfigureAwait(false);
-
-        while (!ct.IsCancellationRequested)
-        {
+            // InitialDelay before the first purge — short so a daily-recycled node
+            // still purges soon after start rather than waiting a full interval it may
+            // never reach.
             try
             {
-                await Task.Delay(_options.ResolvedPurgeInterval, ct).ConfigureAwait(false);
+                await Task.Delay(_options.InitialDelay, ct).ConfigureAwait(false);
             }
             catch (OperationCanceledException)
             {
-                break;
+                return;
             }
 
             await SafePurgeAsync(ct).ConfigureAwait(false);
+
+            while (!ct.IsCancellationRequested)
+            {
+                try
+                {
+                    await Task.Delay(_options.ResolvedPurgeInterval, ct).ConfigureAwait(false);
+                }
+                catch (OperationCanceledException)
+                {
+                    break;
+                }
+
+                await SafePurgeAsync(ct).ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // Shutdown landed mid-purge: SafePurgeAsync rethrows OCE by design so the purge
+            // aborts promptly, but the loop task must complete CLEANLY — StopAsync hands
+            // _loop straight to the host, and a canceled task there is shutdown-log noise
+            // (arch-review 04 round 2, R7). Cancellation here IS the clean exit.
         }
     }