fix(runtime): Primary verdict published from host start, cache boot never adopts malformed bytes, strict drain-gate predicate, HostAbortedException passthrough, seed only Up members

Review R1:
- M1 (#609): DriverHostActor.StopChild releases the instance's resilience state before evicting the hub.
- m2 (#597): DriverHostActor publishes ShouldServiceAsPrimary() to IDriverPrimaryRoleSource at start and on
  cluster membership changes (deduped), so the native-ack gate denies in a pair's boot window.
- m4 (#601): ApplyCachedArtifact returns false on empty/malformed bytes; the cached revision is not adopted,
  Direct mode goes Stale (no RUNNING FROM CACHE), FetchAndCache lands Steady-with-no-revision and a
  re-dispatch of the same revision really applies.
- m3 (#603): LocalDbReplicationPolicy splits into CapturesChanges (PeerAddress||ApiKey, registration) and
  SharesRowsWithPeer (ApiKey && (PeerAddress||SyncListenPort>0), alarm drain gate).
- m5 (#618): Program.cs catch-all filters HostAbortedException (design-time tooling).
- m6 (Cluster-002): ClusterRoleInfo seeds only Up/WeaklyUp members.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/AlarmHistorian.md

@@ -93,6 +93,16 @@ Two postures are deliberate:
 - **Unset (the default) means drain.** So does an unpublished view. A deployment
   that runs no redundancy never publishes a role, and defaulting closed would
   silently stop its alarm history forever.
+- **Only a shared queue is gated.** Standing down is safe only because a peer
+  holds the same rows, so the gate applies only when
+  `LocalDbReplicationPolicy.SharesRowsWithPeer` holds:
+  `LocalDb:Replication:ApiKey` **AND** (`LocalDb:Replication:PeerAddress` **OR**
+  `LocalDb:SyncListenPort > 0`) — an authenticated sync path in either
+  direction. Any other node always drains its own queue. This is deliberately
+  stricter than the table-registration predicate (`PeerAddress` OR `ApiKey`):
+  a key with no dial and no listener (e.g. a fleet-wide secret on an unpaired
+  node) captures changes but shares them with nobody, and gating it would park
+  its events behind a Primary that does not hold them (review R1 m3).
 - **A gate that throws means "not now", never permission.** Draining on a gate
   fault would put a pair into dual delivery exactly when its redundancy signal is
   sick.