feat(secrets): cluster replication via SQL Server and Akka.NET (G-7, 0.2.0)

Secrets were per-node SQLite, so a secret written on one node was invisible to
the rest of a cluster. G-7's design resolved the "shared SQL store vs Akka
replicator" fork to build only the former; both are built here so the choice is
a deployment decision (availability vs partition tolerance) rather than a
library limitation.

Two new packages — ZB.MOM.WW.Secrets.Replicator.SqlServer (shared store, plus a
local-store-with-hub mode) and .Replicator.AkkaDotNet (peer-to-peer over
distributed pub/sub). Core gains ISecretsStoreMigrator, one shared
SecretLastWriterWins predicate so no two stores can disagree on a tie, the
transport-agnostic reconciler, and ReplicatingSecretStore — which closes a real
gap: nothing had ever called ISecretReplicator.PublishAsync, so the seam was
inert and local writes would not have propagated at all.

Verified 182 pass / 1 skip / 0 warnings, including 15 live tests against a real
SQL Server 2022 (the SQLite suite ported case-for-case, so any behavioural
divergence between the stores fails) and a 9-test in-process 2-node Akka
cluster over real remoting. A post-build review caught six defects, all fixed
and now covered: both replication modes could not resolve from the container
(no test had built one), an unbounded fetch that broke past SQL Server's
2100-parameter cap, a poison row that aborted the rest of its batch forever,
Enum.Parse on peer input that could restart the actor in a loop, null crypto
blobs crossing the trust boundary, and a silently dropped pull-read failure.

Packed at 0.2.0 and vulnerability-scanned clean; not yet published to the feed.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Replicator.SqlServer/SqlServerSecretReplicator.cs

@@ -0,0 +1,26 @@
+using ZB.MOM.WW.Secrets.Abstractions;
+
+namespace ZB.MOM.WW.Secrets.Replicator.SqlServer;
+
+/// <summary>
+/// Publishes local writes to the shared SQL-Server hub, so a secret written on one node is
+/// immediately visible to every other node that syncs against the same hub.
+/// </summary>
+/// <remarks>
+/// The row is written through <see cref="ISecretStore.ApplyReplicatedAsync"/>, not
+/// <see cref="ISecretStore.UpsertAsync"/> — the hub must record the row <em>verbatim</em>, keeping
+/// the originating node's revision and <c>updated_utc</c>. An upsert would stamp the hub's own
+/// revision and timestamp, and the row would then look newer than the writer's own copy, so it
+/// would bounce straight back on the next sync.
+/// </remarks>
+/// <param name="hub">The shared hub store.</param>
+public sealed class SqlServerSecretReplicator(ISecretReplicationHub hub) : ISecretReplicator
+{
+    /// <inheritdoc />
+    public Task PublishAsync(StoredSecret row, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+
+        return hub.ApplyReplicatedAsync(row, ct);
+    }
+}