fix(runtime): Primary verdict published from host start, cache boot never adopts malformed bytes, strict drain-gate predicate, HostAbortedException passthrough, seed only Up members

Review R1:
- M1 (#609): DriverHostActor.StopChild releases the instance's resilience state before evicting the hub.
- m2 (#597): DriverHostActor publishes ShouldServiceAsPrimary() to IDriverPrimaryRoleSource at start and on
  cluster membership changes (deduped), so the native-ack gate denies in a pair's boot window.
- m4 (#601): ApplyCachedArtifact returns false on empty/malformed bytes; the cached revision is not adopted,
  Direct mode goes Stale (no RUNNING FROM CACHE), FetchAndCache lands Steady-with-no-revision and a
  re-dispatch of the same revision really applies.
- m3 (#603): LocalDbReplicationPolicy splits into CapturesChanges (PeerAddress||ApiKey, registration) and
  SharesRowsWithPeer (ApiKey && (PeerAddress||SyncListenPort>0), alarm drain gate).
- m5 (#618): Program.cs catch-all filters HostAbortedException (design-time tooling).
- m6 (Cluster-002): ClusterRoleInfo seeds only Up/WeaklyUp members.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ServiceCollectionExtensions.cs

@@ -177,11 +177,13 @@ public static class ServiceCollectionExtensions
         // possibly deliver its events. Scoping the gate to "is my queue actually shared?" is what
         // keeps the two scopes from disagreeing.
         // BOTH halves of a pair share the queue, but only one of them dials: the initiator sets
-        // Replication:PeerAddress, its partner carries the shared ApiKey and waits. The predicate is
-        // LocalDbReplicationPolicy - the same one LocalDbSetup uses to decide which nodes capture
-        // changes at all. It deliberately does NOT count SyncListenPort: the passive endpoint is
-        // fail-closed on the key, so a port with no ApiKey shares nothing and must keep draining.
-        var replicated = LocalDbReplicationPolicy.IsConfigured(configuration);
+        // Replication:PeerAddress, its partner carries the shared ApiKey plus SyncListenPort and waits.
+        // The predicate is LocalDbReplicationPolicy.SharesRowsWithPeer: ApiKey AND (PeerAddress OR
+        // SyncListenPort > 0) - an authenticated sync path in either direction. Both auth directions
+        // fail closed, so a path without the key, or a key with no path (a fleet-wide secret on an
+        // unpaired node), shares nothing and must keep draining. Deliberately stricter than the
+        // registration predicate (CapturesChanges) - see the policy's remarks.
+        var replicated = LocalDbReplicationPolicy.SharesRowsWithPeer(configuration);
 
         if (!replicated)
         {