[DO NOT MERGE] Remove unused error instance audit retention period

[abparticular]

Note

Targeted for 7.0 since removing public PowerShell/installer surface is treated as a major-version change.

Important

Should not be merged until ServiceControl 6 to 7 upgrade guide is documented.

Context

AuditRetentionPeriod (ServiceControl/AuditRetentionPeriod) has existed as a setting on the ServiceControl Error (primary) instance since v1.12.1, well before Audit instances existed. Before the 4.0 split, a single ServiceControl instance handled both error and audit data, and this setting controlled how long audit/saga-audit records were retained in its own database.

When ServiceControl 4.0 introduced the dedicated Audit instance, the original Error instance's database wasn't wiped or migrated — it simply stopped ingesting new audit messages. Whatever audit and saga-audit data it had already accumulated stayed in its embedded database, now read-only but still present. AuditRetentionPeriod was deliberately kept on the Error instance after the split specifically to keep expiring that leftover legacy data, enforced by a "Saga Audit Data Retention" custom check (AuditRetentionCustomCheck) that scanned the Error instance's own RavenDB store for leftover saga snapshot documents and failed if no retention period was configured while such data existed — warning operators that it would otherwise accumulate unbounded.

That custom check lived only in the RavenDB 3.5 persister project. When the Raven5 persister was introduced (commit 193f9709a, "No SagaHistory/SagaSnapshot or Audit Retention in Raven5"), the check and its supporting index were deleted outright, because the Raven5 Error instance never stores audit data of any kind — there is no longer any legacy data for the setting to expire. The RavenDB 3.5 persister itself was later removed entirely in #3733.

AuditRetentionPeriod was never cleaned up alongside that change. Since then it has been dead configuration on the Error instance: read from config, held in memory, echoed back out via the /api/configuration endpoint and the PowerShell module, and written back to ServiceControl.exe.config on every save/upgrade — but nothing has read it for any operational purpose since Raven5 shipped.

docs.particular.net's troubleshooting guide still documented the now-nonexistent custom check as a real failure mode; that's being corrected in a companion PR.

What this PR does

Removes AuditRetentionPeriod from the Error instance across every layer that still carried it, while leaving the Audit instance's AuditRetentionPeriod untouched:

• Runtime — Settings.cs, HostApplicationBuilderExtensions.cs (startup banner), ConfigurationApi.cs (/api/configuration response), RavenPersisterSettings.cs / RavenPersistenceConfiguration.cs
• PowerShell module — dropped from PsServiceControl (the Get-ServiceControlInstance output object) and the corresponding New-ServiceControlInstance / Invoke-ServiceControlInstanceUpgrade entries in the module's help XML (which, incidentally, were already documenting a parameter neither cmdlet's source declares — that drift is fixed here too)
• Installer engine — removed from ServiceControlInstance, IServiceControlInstance, ServiceControlAppConfig, ServiceControlUpgradeOptions, and ServiceControlNewInstance (including its unattended-install XML property and the now-redundant old-format detection check, which still works off ForwardErrorMessages/ErrorRetentionPeriod)
• SCMU — deleted the legacy HoursToKeepMessagesBeforeExpiring → AuditRetentionPeriod migration shim in UpgradeServiceControlInstanceCommand, which was migrating a value into a now-dead setting

SettingsList.AuditRetentionPeriod gets a RemovedFrom = 7.0.0, so ServiceControl/AuditRetentionPeriod is silently stripped from existing .exe.config files the first time an instance is upgraded to or past that version, via the same RemoveIfRetired mechanism used for other retired settings (e.g. HoursToKeepMessagesBeforeExpiring).