docs(site-secrets): final-review doc fixes — replication prerequisite, upgrade impact, audit shape

I2: topology guide + Component-SiteRuntime + register row 127 state that a site pair using
deployed secrets must run LocalDb replication. I3: row 127 + topology guide state the upgrade
impact (whole artifact deploy fails and reads Out of date until referenced secrets exist
centrally). M6: audit row carries secrets/missing, no removed field; removal-only deploys write
no central row. M2/M3/I1 as-built notes; CLAUDE.md secrets bullet corrected.

docs/requirements/Component-DeploymentManager.md

@@ -390,7 +390,22 @@ out below.
   deploymentId, secrets: [{name, revision}], missing: [name], success }`, which
   structurally excludes ciphertext. Written on both `DeployCoreAsync` and
   `RetryForSiteAsync`, including the fail-closed path (audited even though
-  nothing was sent).
+  nothing was sent). The row carries `secrets` and `missing` only — there is
+  **no `removed` field** (design §3.7 named one), and a deploy that only
+  removes secrets (the site's last reference dropped, an empty list shipped)
+  writes **no central row**; removals are logged on the site by
+  `DeployedSecretsMirror`.
+- **Secret rotation and live connections.** The site writes and mirrors the
+  shipped secrets before it pushes data connections to the DCL, so a
+  connection created by the same deploy resolves a new secret on first
+  connect; a rotation with unchanged connection config takes effect on that
+  connection's next (re)connect — see Component-SiteRuntime.md → *Deployed
+  Secrets*.
+- **One `secret:` parser.** `SecretReferenceScanner.TryParseSecretReference`
+  (trimmed, case-insensitive prefix, trimmed name; `${secret:…}` never
+  matches) is shared by the scanner and every adapter that resolves the
+  reference (today `MxGatewayDataConnection`'s `ApiKey`), so the name central
+  ships is exactly the name the site looks up.
 - **Central store.** Central resolves secrets from `ISecretStore`, composed by
   the Host per `Secrets:Store:Provider` — see Component-Host.md → *Secrets*.
 - **Site apply and the per-node mirror** — see Component-SiteRuntime.md →