docs(secrets): live convergence gate results - SQL hub PASSES 6/6, Akka FAILS

SQL-Server hub topology (ScadaBridge) is live-validated against a real SQL Server
2022 with two nodes: write->resolve via hub, tombstone propagation without
resurrection, bidirectional sweep, partitioned-node local resolution (site
autonomy - the reason hub mode was chosen), and wrong-KEK fail-closed via
SecretDecryptionException.

Akka peer-to-peer topology (OtOpcUa) FAILS the gate: resolving ISecretReplicator
hangs indefinitely in a real clustered process. Reproduced twice on a healthy
2-node cluster; isolated to constructing AkkaSecretReplicator -> ActorRef ->
system.ActorOf, NOT nested DI resolution. The library's own 2-node suite passes,
so the trigger is creation through DI in a hosted process. Root cause not yet
identified.

Impact: OtOpcUa would hang at startup if replication were enabled, since the
startup hook resolves ISecretStore. Harmless today only because the flag defaults
false. Do NOT enable Secrets:Replication:Enabled in OtOpcUa.

The gate did its job - it caught a blocking defect that every offline suite,
including the library's own real-cluster tests, had passed over.

docs/plans/2026-07-18-secrets-0.2.0-upgrade-and-clustering.md.tasks.json

@@ -99,7 +99,7 @@
       "id": 9,
       "nativeId": "15",
       "subject": "Task 9: Live convergence gate (both clustered apps)",
-      "status": "pending",
+      "status": "completed",
       "classification": "high-risk",
       "blockedBy": [
         6,
@@ -110,7 +110,7 @@
       "id": 10,
       "nativeId": "16",
       "subject": "Task 10: Docs reconcile",
-      "status": "pending",
+      "status": "completed",
       "classification": "small",
       "blockedBy": [
         9
@@ -124,5 +124,5 @@
     }
   ],
   "lastUpdated": "2026-07-18",
-  "notes": "Tasks 1-8 complete on local feat/secrets-0.2.0 branches in 4 repos (not pushed). Apps ended on Secrets 0.2.1, not 0.2.0: adoption uncovered that 0.2.0's Akka replicator was silently inert (TryAdd order); fixed and republished. Task 9 (live gate) NOT done - needs 2-node rigs. Replication is default-OFF everywhere, so nothing ships enabled."
+  "notes": "Tasks 1-10 complete. Live gate RUN 2026-07-18 with a SPLIT result: SQL-Server hub (ScadaBridge) PASSED 6/6 against a real SQL Server 2022 incl. partition survival and wrong-KEK fail-closed. Akka peer-to-peer (OtOpcUa) FAILED - resolving ISecretReplicator deadlocks in a real clustered process at ActorOf. Replication remains default-OFF everywhere; do NOT enable it in OtOpcUa until the deadlock is fixed."
 }