fix(runtime): Primary verdict published from host start, cache boot never adopts malformed bytes, strict drain-gate predicate, HostAbortedException passthrough, seed only Up members

Review R1:
- M1 (#609): DriverHostActor.StopChild releases the instance's resilience state before evicting the hub.
- m2 (#597): DriverHostActor publishes ShouldServiceAsPrimary() to IDriverPrimaryRoleSource at start and on
  cluster membership changes (deduped), so the native-ack gate denies in a pair's boot window.
- m4 (#601): ApplyCachedArtifact returns false on empty/malformed bytes; the cached revision is not adopted,
  Direct mode goes Stale (no RUNNING FROM CACHE), FetchAndCache lands Steady-with-no-revision and a
  re-dispatch of the same revision really applies.
- m3 (#603): LocalDbReplicationPolicy splits into CapturesChanges (PeerAddress||ApiKey, registration) and
  SharesRowsWithPeer (ApiKey && (PeerAddress||SyncListenPort>0), alarm drain gate).
- m5 (#618): Program.cs catch-all filters HostAbortedException (design-time tooling).
- m6 (Cluster-002): ClusterRoleInfo seeds only Up/WeaklyUp members.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/LocalDbRegistration.cs

@@ -46,7 +46,7 @@ public static class LocalDbRegistration
     ///     Configuration key carrying the dedicated h2c sync listener's port. Zero or absent means
     ///     no listener is bound and the passive sync endpoint is not mapped.
     /// </summary>
-    public const string SyncListenPortKey = "LocalDb:SyncListenPort";
+    public const string SyncListenPortKey = Runtime.LocalDbReplicationPolicy.SyncListenPortKey;
 
     /// <summary>
     ///     The port the dedicated cleartext-HTTP/2 sync listener should bind, or <c>0</c> when the

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/LocalDbSetup.cs

@@ -170,9 +170,9 @@ public static class LocalDbSetup
     /// <returns><c>true</c> when this node is configured to replicate.</returns>
     public static bool ReplicationIsConfigured(IConfiguration configuration)
     {
-        // Shared with the alarm-historian drain gate (#603): one predicate, so the nodes that capture
-        // changes and the nodes that stand down for a peer can never disagree.
-        return Runtime.LocalDbReplicationPolicy.IsConfigured(configuration);
+        // Defined beside the alarm-historian drain gate's stricter predicate (#603, review R1 m3): every node
+        // the gate treats as sharing rows also captures, so the two never disagree in the harmful direction.
+        return Runtime.LocalDbReplicationPolicy.CapturesChanges(configuration);
     }
 
     /// <summary>Opts every replicated table into change capture, baselining what is already there.</summary>