chore(secrets): adopt ZB.MOM.WW.Secrets 0.6.2 — fail-closed store-path validation

Four-minor jump 0.2.3 → 0.6.2. The release line exists because a deploy
renaming the app directory took the MxGateway credential store with it
(2026-08-09, two silent days): Secrets:SqlitePath must now be absolute AND
outside the content root, rejected at boot rather than relocated. 0.6.2 over
0.6.1 is message-only (the rejection text now teaches the mounted-volume
case and forecloses the override hunt) — the live rig evidence below was
gathered at 0.6.1 and the validator behavior is identical.

Adoption changes beyond the pins:

- appsettings.json drops the relative "otopcua-secrets.db" (now boot-fatal);
  dev gets the library's absolute per-user default, deployments supply their
  own (wonder already pins an absolute out-of-root path in the service env).
- Program.cs's pre-host ${secret:} expander now calls the FOUR-argument
  AddZbSecrets with builder.Environment.ContentRootPath. This call site is
  the actual fix, not the pin: the throwaway container has no
  IHostEnvironment, and without the explicit root the under-content-root
  rule is skipped at exactly the moment the migrator creates the store file
  (the 0.6.0 defect). Do NOT simplify back to the 3-argument overload — it
  compiles and silently reopens the gap. Pinned by a Program.cs source-scan
  test AND a runtime falsification control that RUNS the migration and
  demonstrably creates the store at the rejected path under the 3-arg form.
- docker-dev: Secrets__SqlitePath moves /app/data → /data via a SECOND mount
  of the same per-node volume (same file at the volume root, so seeded
  stores carry over) because /app is the container's content root and the
  new rule correctly rejects it. LocalDb stays on /app/data (secrets-only
  rule).
- SecretsStorePathValidationTests: positive-control probes, artifact-first
  (relative and in-content-root paths must FAIL leaving no file; outside-
  root passes; the no-explicit-root control proves the file assertions can
  fail) — a clean boot is equally consistent with the validator never being
  wired.

Live-verified on the six-node docker-dev rig (at 0.6.1): all nodes boot
under the new validation with stores at /data; an AdminUI-written secret
converged into BOTH central nodes' independent stores; site-a held only its
own pair's secrets (Phase 6 pair-local isolation intact). Replicator wire
behavior unchanged 0.3.0–0.6.x per CHANGELOG; registration-graph pins and
the full suite pass.

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -100,9 +100,14 @@ if (roleSuffix is not null)
 // it also migrates the secrets SQLite store on startup.
 // ASP0000: DELIBERATE throwaway container — expansion must run before builder.Build(), so it
 // cannot use the app's DI. Fully disposed here; shares no singletons with the host container.
+// The content root is passed EXPLICITLY (Secrets 0.6.1 four-argument overload): this throwaway
+// container has no IHostEnvironment, and without the explicit root the under-content-root store
+// rule is skipped at exactly the moment the migrator creates the store file — a rejected path
+// would get an empty database written to it here before the real host aborts a second later
+// (the 0.6.0 defect HistorianGateway's adoption found). Pinned by a Program.cs source-scan test.
 #pragma warning disable ASP0000
 await using (var secretsProvider = new ServiceCollection()
-    .AddZbSecrets(builder.Configuration, "Secrets")
+    .AddZbSecrets(builder.Configuration, "Secrets", builder.Environment.ContentRootPath)
     .BuildServiceProvider())
 #pragma warning restore ASP0000
 {

src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.json

@@ -12,7 +12,6 @@
     }
   },
   "Secrets": {
-    "SqlitePath": "otopcua-secrets.db",
     "MasterKey": {
       "Source": "Environment",
       "EnvVarName": "ZB_SECRETS_MASTER_KEY"