docs(secrets): reconcile 0.2.1 adoption - what was proven vs merely built

- All 4 apps on 0.2.1 (local branches, unpushed).
- Records the corrected security story: the version bump closed NO advisory (all four
  repos already resolved patched 2.1.12); the real live vulnerability was in ScadaBridge,
  masked by a NuGetAuditSuppress, and was fixed by separate work.
- Records the upstream 0.2.0 inert-Akka-replicator defect, its root cause (DI extensions
  with no container-building test - third instance of that class), and the 0.2.1 fix.
- Marks clustered topology WIRED-but-default-OFF and explicitly NOT live-validated;
  Task 9 remains open and the topology is not 'adopted' until it passes.

docs/plans/2026-07-16-secrets-adoption-otopcua.md

@@ -1,4 +1,16 @@
 # OtOpcUa — Secrets Adoption (G-2, G-4, G-5, G-6) Implementation Plan
+
+> **✅ EXECUTED 2026-07-16** — merged to `origin/master` @ `872cf7e3`, G-2 live-proven against the
+> real production MxGateway. This document is the **historical record** of that adoption; the
+> `0.1.2` pins throughout are what was landed then, **not** what to use now.
+>
+> **Follow-on (not yet executed):** bump to `0.2.0` and adopt clustered replication —
+> [`2026-07-18-secrets-0.2.0-upgrade-and-clustering.md`](2026-07-18-secrets-0.2.0-upgrade-and-clustering.md),
+> Tasks 3, 5, 6, 9. OtOpcUa's recommended topology is **Akka peer-to-peer**
+> (`ZB.MOM.WW.Secrets.Replicator.AkkaDotNet`): it is a single Akka cluster on 1.5.62, already uses
+> `DistributedPubSub` in product code, registers its `ActorSystem` in DI via `Akka.Hosting`, and
+> its driver-role nodes benefit from resolving Layer-B driver secrets while partitioned.
+
 > **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans to implement this plan task-by-task. Shared context: docs/plans/2026-07-16-secrets-adoption-design.md.
 
 **Goal:** Adopt the already-built, already-published `ZB.MOM.WW.Secrets` library (@ `0.1.2`, Gitea feed, reference-consumer-proven in HistorianGateway) into **OtOpcUa** — retiring plaintext credentials at rest. Covers **G-4** (pre-host `${secret:}` config-secret expansion), **G-6** (mount `/admin/secrets` UI), **G-5** (clustered master-key posture), and the highest-value gap **G-2** (retire cleartext-in-DB driver secrets via runtime `ISecretResolver`).