fix(runtime): Primary verdict published from host start, cache boot never adopts malformed bytes, strict drain-gate predicate, HostAbortedException passthrough, seed only Up members

Review R1:
- M1 (#609): DriverHostActor.StopChild releases the instance's resilience state before evicting the hub.
- m2 (#597): DriverHostActor publishes ShouldServiceAsPrimary() to IDriverPrimaryRoleSource at start and on
  cluster membership changes (deduped), so the native-ack gate denies in a pair's boot window.
- m4 (#601): ApplyCachedArtifact returns false on empty/malformed bytes; the cached revision is not adopted,
  Direct mode goes Stale (no RUNNING FROM CACHE), FetchAndCache lands Steady-with-no-revision and a
  re-dispatch of the same revision really applies.
- m3 (#603): LocalDbReplicationPolicy splits into CapturesChanges (PeerAddress||ApiKey, registration) and
  SharesRowsWithPeer (ApiKey && (PeerAddress||SyncListenPort>0), alarm drain gate).
- m5 (#618): Program.cs catch-all filters HostAbortedException (design-time tooling).
- m6 (Cluster-002): ClusterRoleInfo seeds only Up/WeaklyUp members.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -749,7 +749,10 @@ if (LogPipelineDiagnostics.CheckFileSinkGrowth(app.Configuration,
 
 await app.RunAsync();
 }
-catch (Exception ex)
+// HostAbortedException is how design-time tooling (EF `dotnet ef … --startup-project`, OpenAPI generators —
+// HostFactoryResolver) stops Program once it has the built host. It is not a failure: letting it reach the
+// Fatal + Environment.Exit(1) below would kill the tool's own process (#618, review R1 m5).
+catch (Exception ex) when (ex is not HostAbortedException)
 {
     // Log.Logger is still the silent bootstrap logger when the failure happened before AddZbSerilog
     // ran (e.g. EffectiveRoles.Resolve), so ALSO write to stderr — the one channel that always exists.