feat(deploy): PendingUpdatesEvaluator — one fleet snapshot of stale instances and stale-artifact sites

One scoped read that answers "is anything waiting to be deployed?" for the whole
fleet: each site's stored artifact revision hash compared against what a deploy
would send right now (NeverDeployed / Current / OutOfDate), plus per-site
deployed/stale/unknown instance tallies from the batched staleness evaluation.
NeverDeployed is deliberately NOT a pending update — the operator has not deployed
yet — and exceptions propagate so the caller's single-flight cache can render
"unavailable" rather than invent an "up to date". Adds the validated
PendingUpdatesCacheTtl (60 s) that TTL will key off.

Claude-Session: https://claude.ai/code/session_01Y5ef34iUUMjmwnMpL9xgmB

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/DeploymentManagerOptions.cs

@@ -75,4 +75,19 @@ public class DeploymentManagerOptions
     /// </para>
     /// </summary>
     public TimeSpan TerminalDeploymentRecordRetention { get; set; } = TimeSpan.FromDays(365);
+
+    /// <summary>
+    /// How long the Central UI pending-updates snapshot stays fresh; one fleet
+    /// flatten per TTL while any Deployer/Administrator circuit is open.
+    ///
+    /// <para>
+    /// The snapshot is a whole-fleet read (every site's artifact hash plus every
+    /// deployed instance's staleness), so it is held behind a single-flight TTL
+    /// cache: however many circuits poll, and however often, the fleet is evaluated
+    /// at most once per this window — and not at all when nobody is looking. Must be
+    /// positive; zero would make every poll a cache miss and re-flatten the fleet per
+    /// circuit, which is precisely the cost the cache exists to avoid.
+    /// </para>
+    /// </summary>
+    public TimeSpan PendingUpdatesCacheTtl { get; set; } = TimeSpan.FromSeconds(60);
 }