feat(mesh): gRPC command fan-out behind Mode=Grpc

MeshGrpcCommandDialer places one NodeCommandService.Execute call on one
node: a GrpcChannel cached per endpoint (the GrpcDeploymentArtifactFetcher
shape), the TARGET node's cluster's bearer plus x-otopcua-cluster naming
that cluster, and a per-call deadline linked to the caller's token. A
cluster with no resolvable key is refused locally with Unauthenticated —
there is no arm on which a command leaves central unauthenticated, even
one the far side would have rejected.

CentralCommunicationActor gains the third mode branch. The contact load
now also projects GrpcPort and, from the SAME rows in the SAME pass,
builds the dispatch set — which is what makes 'the gRPC fan reaches
exactly the SendToAll recipient set' structural rather than two queries
that have to keep agreeing. A row with a null GrpcPort is skipped
warn-once (the TelemetryNodeSource precedent). Per-node results are
piped back for LOGGING ONLY: named node, gRPC status, dropped. No retry,
no queue.

Every dial is scheduled on the thread pool rather than called from the
receive. Found by review and pinned red-first: an async method runs
synchronously to its first await, and the dialer's pre-await work is
TryGetPsk, which blocks on the secret store — bounded but seconds, and
repeated after every refresh since the refresh drops the cache. Dialing
inline parked the actor's mailbox, so deployment acks queued behind a
slow node; the regression test tells an ApplyAck while a dial is held
and fails without the hop.

The contact refresh also wires the Phase 1A register: it publishes the
loaded cluster ids as the PSK provider's known-cluster set and drops the
key cache, so a rotated key takes effect within one ContactRefreshSeconds.
Neither happens under Dps or ClusterClient.

Both existing mode branches are behaviourally untouched and every
existing fact passes unmodified. The one edit to shared text: the
Status.Failure warning drops the word 'ClusterClient', since that handler
now serves all three transports.

ControlPlane.Tests 205 -> 230, Host.Tests 92, Cluster.Tests 184, 0 warnings.

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -534,6 +534,14 @@ if (hasAdmin)
     // Depends on ISecretResolver, which AddOtOpcUaSecrets registers unconditionally below (DI
     // registration order is irrelevant; resolution order is not).
     builder.Services.AddSingleton<IMeshPskProvider, MeshPskProvider>();
+    // Central's outbound command dial (ClusterClient→gRPC Phase 1A). Admin-only for the same reason
+    // as the provider above — a node never dials another node — and singleton because it owns a
+    // GrpcChannel per node endpoint; per-call channels would leak sockets across a fleet-wide fan.
+    // Registered in every mode: CentralCommunicationActor only reaches it under Mode=Grpc, and an
+    // idle registration costs nothing, whereas gating it here would mean flipping the mode on a
+    // running fleet needs a central restart before any command lands — the same reasoning that
+    // registers the ClusterClient receptionist unconditionally.
+    builder.Services.AddSingleton<IMeshCommandDialer, MeshGrpcCommandDialer>();
 }
 
 // Registered unconditionally: driver-role nodes resolve Layer-B DriverConfig secrets and have no auth/DP/AdminUI.