feat(deploy): PendingUpdatesEvaluator — one fleet snapshot of stale instances and stale-artifact sites

One scoped read that answers "is anything waiting to be deployed?" for the whole
fleet: each site's stored artifact revision hash compared against what a deploy
would send right now (NeverDeployed / Current / OutOfDate), plus per-site
deployed/stale/unknown instance tallies from the batched staleness evaluation.
NeverDeployed is deliberately NOT a pending update — the operator has not deployed
yet — and exceptions propagate so the caller's single-flight cache can render
"unavailable" rather than invent an "up to date". Adds the validated
PendingUpdatesCacheTtl (60 s) that TTL will key off.

Claude-Session: https://claude.ai/code/session_01Y5ef34iUUMjmwnMpL9xgmB

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/DeploymentManagerOptionsValidator.cs

@@ -43,6 +43,12 @@ public sealed class DeploymentManagerOptionsValidator : OptionsValidatorBase<Dep
             $"(was {options.SiteDeploymentReconcileTimeout}); it bounds each query-before-redeploy " +
             $"reconciliation inside a bulk site deployment's serial prepare phase.");
 
+        builder.RequireThat(options.PendingUpdatesCacheTtl > TimeSpan.Zero,
+            $"ScadaBridge:DeploymentManager:PendingUpdatesCacheTtl must be a positive duration " +
+            $"(was {options.PendingUpdatesCacheTtl}); it is the freshness window of the Central UI " +
+            $"pending-updates snapshot, and a non-positive value would re-flatten the whole fleet on " +
+            $"every poll of every open circuit.");
+
         builder.RequireThat(options.TerminalDeploymentRecordRetention >= TimeSpan.Zero,
             $"ScadaBridge:DeploymentManager:TerminalDeploymentRecordRetention must not be negative " +
             $"(was {options.TerminalDeploymentRecordRetention}); use TimeSpan.Zero to disable purging of " +