refactor(health): adopt the shared active-node check (Health 0.3.0)

ClusterPrimaryHealthCheck was written three days' worth of debugging ago because
the shared ActiveNodeHealthCheck selected by RoleLeader and reported Healthy for
any node lacking the role. Health 0.3.0 fixes the shared check — oldest Up
member, role-preference scoping, Unhealthy when the node owns no active work —
so the private copy is now duplication rather than a workaround, and it is
deleted.

RolePreference [admin, driver] reproduces exactly what it did: a fused central
node answers for admin (where the singletons and the AdminUI are pinned), a
driver-only site node answers for driver.

SelectOldestUpMemberOfRole now delegates to the shared ClusterActiveNode instead
of re-implementing the age ordering. This is the point of the change rather than
a tidy-up: the redundancy snapshot drives the OPC UA ServiceLevel 250/240 split
while the health tier drives Traefik's admin routing, so two copies of "oldest Up
member of a role" would be two chances to advertise one node as authoritative
while gating the data plane on another. ControlPlane takes a ZB.MOM.WW.Health.Akka
reference for it; the layering trade-off is recorded at the PackageReference.

Behaviour note: a node carrying neither admin nor driver now answers 503 on the
active tier instead of 200. That case is reachable — RoleParser admits dev-only
and cluster-role-only nodes — and 503 is correct, since such a node owns no
active work and must not be in an active-tier pool. No docker-dev node is
affected: every rig node is admin+driver or driver-only.

Tests replaced in kind. The rule itself is now pinned in the library against a
real two-node cluster; what stays OtOpcUa's own decision is the wiring, so
ActiveTierRegistrationTests pins which check is on the active tag, that it is
registered on driver-only nodes too, and that it is not on the ready tier.

Verified: Host.Tests 25/25, ControlPlane redundancy 15/15.

src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Redundancy/RedundancyStateActor.cs

@@ -2,6 +2,7 @@ using Akka.Actor;
 using Akka.Cluster;
 using Akka.Cluster.Tools.PublishSubscribe;
 using Akka.Event;
+using ZB.MOM.WW.Health.Akka;
 using ZB.MOM.WW.OtOpcUa.Cluster;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Redundancy;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
@@ -152,22 +153,28 @@ public sealed class RedundancyStateActor : ReceiveActor, IWithTimers
     /// <param name="role">The cluster role to scope the selection to.</param>
     /// <returns>The oldest Up member's address for that role, or <c>null</c> when there is none.</returns>
     /// <remarks>
-    /// The age-ordering rationale in <see cref="SelectDriverPrimary"/> applies verbatim to any role:
-    /// oldest, never <c>RoleLeader</c>. Factored out so the rule has exactly one implementation —
-    /// the health tier that reports which node is active needs the same answer the redundancy
-    /// snapshot does, and two copies of "oldest Up member of a role" would be two chances to
-    /// silently disagree about who is in charge.
+    ///     <para>
+    ///         The age-ordering rationale in <see cref="SelectDriverPrimary"/> applies verbatim to any
+    ///         role: oldest, never <c>RoleLeader</c>. The rule itself lives in the shared
+    ///         <see cref="ClusterActiveNode"/> (<c>ZB.MOM.WW.Health.Akka</c> 0.3.0) so it has exactly
+    ///         one implementation family-wide — this method is the control plane's entry point into it.
+    ///     </para>
+    ///     <para>
+    ///         Delegating rather than re-implementing is what keeps the redundancy snapshot and the
+    ///         <c>/health/active</c> tier structurally in agreement. They answer for different
+    ///         consumers — the OPC UA <c>ServiceLevel</c> 250/240 split reads this election, while an
+    ///         orchestrator routes admin traffic by the health tier — so a divergence would advertise
+    ///         one node as authoritative while gating the data plane on another. Both apps in the
+    ///         family previously kept private copies of this rule, and both got it wrong in a
+    ///         different way.
+    ///     </para>
     /// </remarks>
     public static Address? SelectOldestUpMemberOfRole(IEnumerable<Member> members, string role)
     {
         ArgumentNullException.ThrowIfNull(members);
         ArgumentException.ThrowIfNullOrWhiteSpace(role);
 
-        return members
-            .Where(m => m.Status == MemberStatus.Up && m.Roles.Contains(role))
-            .OrderBy(m => m, Member.AgeOrdering)
-            .FirstOrDefault()
-            ?.Address;
+        return ClusterActiveNode.OldestUpMember(members, role)?.Address;
     }
 
     private IReadOnlyList<NodeRedundancyState> BuildSnapshot()

src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/ZB.MOM.WW.OtOpcUa.ControlPlane.csproj

@@ -19,6 +19,14 @@
              Google.Protobuf + Grpc.Core.Api flow transitively from Commons (the generated client). -->
         <PackageReference Include="Grpc.Net.Client"/>
         <PackageReference Include="ZB.MOM.WW.Audit"/>
+        <!-- For ClusterActiveNode — the shared "oldest Up member of role X" primitive. The control
+             plane and the /health/active tier must give the SAME answer for which node is in charge,
+             or the tier reports one node active while the Primary-gated data plane runs on another;
+             delegating here is what makes that structural rather than a convention. It lives in
+             Health.Akka because that is the family's Akka-cluster utility package (it already hosts
+             AkkaClusterStatusPolicy and an endpoint gate); a dedicated cluster package would be a
+             better home if a third such primitive ever appears. -->
+        <PackageReference Include="ZB.MOM.WW.Health.Akka"/>
     </ItemGroup>
 
     <ItemGroup>