fix(docker-dev): wire OTOPCUA_ACL_ENABLED to the centrals; record the S18 follow-up

The R3-05 gate's own recipe correction, actioned. Security__Acl__Enabled:
"${OTOPCUA_ACL_ENABLED:-false}" was wired to site-a-1/site-a-2 only, so
`OTOPCUA_ACL_ENABLED=true docker compose up -d central-1 central-2` was a silent
no-op ("Running", no recreate, no env) — on the one node kind that carries
BoundedApiKeyStore at all, since only a fused admin+driver node wraps
ConfigDbApiKeyStore. The gate had to proceed via a scratch compose override.

The key is now on central-1 and central-2 too, same env var and same default
false, so today's rig behaviour is byte-identical and the plan's step 1 does what
it says. site-b stays hardcoded OFF as the A/B control.

Plan gains a "## S18 hard-deadline follow-up (2026-08-20)" section: the
cooperative-vs-hard root cause, the red-before-green observation (3/18 failing
with TimeoutException, and why the 15 existing deadline tests could not see it),
the fix, and the still-owed live re-gate table (expected vs. what the gate saw).

docker-dev/docker-compose.yml

@@ -403,6 +403,13 @@ services:
       Security__Ldap__ServiceAccountPassword: "serviceaccount123"
       Security__DeployApiKey: "docker-dev-deploy-key"
       Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}"
+      # #520 stage 6 — node ACL enforcement, the dark switch. Default OFF, exactly as in production.
+      # The centrals read the SAME env override as the site-a pair, so an ACL live gate can enable it
+      # where BoundedApiKeyStore actually lives (only a fused admin+driver node wraps ConfigDbApiKeyStore):
+      #   OTOPCUA_ACL_ENABLED=true docker compose -f docker-dev/docker-compose.yml up -d central-1 central-2
+      # Added 2026-08-20: the R3-05 gate found this key wired only to site-a-1/2, so that command was a
+      # silent no-op on the centrals and the gate needed a scratch compose override to proceed.
+      Security__Acl__Enabled: "${OTOPCUA_ACL_ENABLED:-false}"
       # Map the shared-GLAuth data-plane groups (ReadOnly/WriteOperate/...) to data-plane role
       # strings the OPC UA session ACL gates read. The DB LdapGroupRoleMapping is AdminRole-typed
       # (AdminUI roles); this free-form GroupToRole baseline is the path for data-plane roles.
@@ -529,6 +536,10 @@ services:
       Security__Ldap__ServiceAccountPassword: "serviceaccount123"
       Security__DeployApiKey: "docker-dev-deploy-key"
       Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}"
+      # Node ACL enforcement, the dark switch — same env override and same default-OFF as central-1.
+      # Both centrals must carry it: `up -d central-1 central-2` recreates both, and a pair split across
+      # two enforcement postures is not a rig anyone can reason about.
+      Security__Acl__Enabled: "${OTOPCUA_ACL_ENABLED:-false}"
       # Data-plane group→role baseline (see central-1).
       Security__Ldap__GroupToRole__ReadOnly: "ReadOnly"
       Security__Ldap__GroupToRole__WriteOperate: "WriteOperate"