docs(secrets): reconcile 0.2.1 adoption - what was proven vs merely built

- All 4 apps on 0.2.1 (local branches, unpushed).
- Records the corrected security story: the version bump closed NO advisory (all four
  repos already resolved patched 2.1.12); the real live vulnerability was in ScadaBridge,
  masked by a NuGetAuditSuppress, and was fixed by separate work.
- Records the upstream 0.2.0 inert-Akka-replicator defect, its root cause (DI extensions
  with no container-building test - third instance of that class), and the 0.2.1 fix.
- Marks clustered topology WIRED-but-default-OFF and explicitly NOT live-validated;
  Task 9 remains open and the topology is not 'adopted' until it passes.

docs/plans/2026-07-16-secrets-adoption-mxaccessgw.md

@@ -1,4 +1,15 @@
 # MxAccessGateway — Secrets Adoption (G-4, G-5, G-6) Implementation Plan
+
+> **✅ EXECUTED 2026-07-16** — merged to `origin/main` @ `e088dfa`, box-verified fail-closed and
+> encrypt-at-rest. This document is the **historical record**; the `0.1.2` pins are what was
+> landed then, **not** what to use now.
+>
+> **Follow-on (not yet executed):** a **version bump only** —
+> [`2026-07-18-secrets-0.2.0-upgrade-and-clustering.md`](2026-07-18-secrets-0.2.0-upgrade-and-clustering.md)
+> Task 2. This app is a single Windows/NSSM box with no Akka clustering, so **no replication
+> package and no topology apply**. The bump still matters: `0.2.0` carries a high-severity
+> transitive `SQLitePCLRaw` advisory fix that `0.1.2` lacks.
+
 > **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans to implement this plan task-by-task. Shared context: docs/plans/2026-07-16-secrets-adoption-design.md.
 
 **Goal:** Adopt the already-built, already-published `ZB.MOM.WW.Secrets` library (`0.1.2`, Gitea feed, reference-consumer-proven in HistorianGateway) into **MxAccessGateway** — retiring the plaintext LDAP bind password (and any password-bearing config) at rest behind pre-host `${secret:}` expansion, adding a runtime `ISecretResolver`, and mounting the `/admin/secrets` Blazor UI. Covers gaps **G-4** (pre-host config-secret expansion), **G-5** (master-key provider), and **G-6** (mount UI). There is **no G-2/G-3** for this app — it has no database-resident driver/connection secrets.