fix(grpc): keep the RpcException off the failover warning so no sink can render Status.Detail

Review follow-ups: the warning now carries only the two endpoint URIs and the
status code — attaching the exception object would let any real sink render
its ToString(), which for RpcException includes server-authored Status.Detail.
The leak pin test now also asserts no exception rides on the warning, via a
new WarningExceptions capture on RecordingLogger. Plus two cosmetic nits:
unified ThrowIfNull idiom, documented that FallbackEndpoints mutation after
Validate is unsupported.

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Replicator.Grpc/SecretsGrpcHubClientOptions.cs

@@ -38,8 +38,10 @@ public sealed class SecretsGrpcHubClientOptions
     /// </summary>
     /// <remarks>
     /// Getter-only so the configuration binder adds entries to this instance rather than needing a
-    /// setter. Each entry carries the same http-cleartext caveat as <see cref="Endpoint"/>: a plain
-    /// <c>http</c> fallback sends <see cref="BearerToken"/> in cleartext on every failed-over call.
+    /// setter. Mutating the list after <see cref="Validate"/> has run is unsupported — the DI
+    /// extension reads it exactly once, at registration, to shape the channel graph. Each entry
+    /// carries the same http-cleartext caveat as <see cref="Endpoint"/>: a plain <c>http</c>
+    /// fallback sends <see cref="BearerToken"/> in cleartext on every failed-over call.
     /// </remarks>
     public IList<string> FallbackEndpoints { get; } = [];