docs(health): resolve spec/contract/gaps consistency (review fixes)

Applies canonical resolutions for eight settled decisions:
- GAPS: remove three stale "Decisions still open" bullets (#1 IActiveNodeGate placement, #2 GrpcChannel type, #3 OtOpcUaCompat named constant)
- Shared contract: AkkaClusterHealthCheck, ActiveNodeHealthCheck constructors take IServiceProvider (lazy ActorSystem, Degraded-when-not-ready)
- Shared contract: AkkaActiveNodeGate takes IServiceProvider; reads SelfMember+leader directly, null-guarded; does not proxy ActiveNodeHealthCheck
- Shared contract: DatabaseHealthCheckOptions.Probe renamed to ProbeQuery; consumer matrix updated
- Shared contract: settled AddZbHealthChecks open question removed (spec §5 is per-project AddHealthChecks)
- SPEC §2.2: OtOpcUaCompat Leaving/Exiting cell updated from — to Degraded + footnote; §2.3 startup-safety note added
- README: status line corrected from "built and tested" to "scaffolded … implementation is follow-on (task #7)"; IActiveNodeGate "left per-project" bullet removed
- OtOpcUa current-state: AddZbHealthChecks → AddHealthChecks().AddCheck<...>(); IClusterRoleInfo note reframed as accepted trade-off
- ScadaBridge current-state: IActiveNodeGate bullet rewritten — interface moves to ZB.MOM.WW.Health on adoption, InboundApiEndpointFilter references shared interface

components/health/current-state/otopcua/CURRENT-STATE.md

@@ -131,15 +131,19 @@ probe in `ZB.MOM.WW.Health` would close.
   The delegate preserves the stricter query probe rather than falling back to `CanConnectAsync`.
 - Add `GrpcDependencyHealthCheck` targeting the MxAccessGateway channel (closes the downstream
   dependency gap noted in §4). Tag `["ready","active"]`.
-- Replace `AddOtOpcUaHealth` / `MapOtOpcUaHealth` with `services.AddZbHealthChecks()` +
+- Replace `AddOtOpcUaHealth` / `MapOtOpcUaHealth` with
+  `services.AddHealthChecks().AddCheck<...>()` (one call per probe, per spec §5) +
   `app.MapZbHealth()`. The `/healthz` bare-liveness tier is part of `MapZbHealth` by default —
   no separate wiring needed.
 
 **Keep bespoke:**
 
-- `IClusterRoleInfo` and its Akka implementation — this is an OtOpcUa abstraction used for more
-  than health checks; it should remain in the OtOpcUa codebase. The shared `ActiveNodeHealthCheck`
-  will accept `IClusterRoleInfo` (or an equivalent cluster-info abstraction) as an injection point.
+- `IClusterRoleInfo` and its Akka implementation — on adoption this testability seam is given up
+  for the health-check path. The shared `ActiveNodeHealthCheck` reads cluster role state from the
+  ActorSystem directly (resolving it lazily via `IServiceProvider`); it does not accept
+  `IClusterRoleInfo` as an injection point. This is an accepted trade-off: the shared implementation
+  is simpler and consistent across projects, while `IClusterRoleInfo` remains available elsewhere
+  in the OtOpcUa codebase where it is used outside health checks.
 - The `AllowAnonymous` policy — this is an OtOpcUa auth concern; `MapZbHealth` must document that
   callers are responsible for applying `AllowAnonymous` (or the shared helper applies it by default).
 - Which probes are registered and their tag assignments — the shared library supplies the check

components/health/current-state/scadabridge/CURRENT-STATE.md

@@ -172,9 +172,10 @@ regardless of shared-library adoption.
 
 - `HealthMonitoring/` domain pipeline (`SiteHealthCollector`, `CentralHealthAggregator`, etc.) —
   entirely per-project, no shared-library equivalent.
-- `IActiveNodeGate` from the `InboundAPI` project is the contract the `InboundApiEndpointFilter`
-  depends on; it can be implemented by the shared `ActiveNodeHealthCheck` backing service but the
-  interface definition stays in the InboundAPI project (or moves to a shared abstractions package).
+- `IActiveNodeGate` moves from the `InboundAPI` project to `ZB.MOM.WW.Health` (core package) on
+  adoption. `InboundApiEndpointFilter` references the shared interface; `AkkaActiveNodeGate`
+  (from `ZB.MOM.WW.Health.Akka`) becomes the singleton implementation registered in DI. The
+  interface definition is no longer owned by the `InboundAPI` project.
 - The Central UI's `/monitoring/health` endpoint — powered by `CentralHealthAggregator`, not by
   ASP.NET health checks.
 - The comment at `Program.cs:217–221` explains the readiness design decision (standby nodes are