Probes the injected client with a select that matches nothing.

IAuditDbClient exposes only insert and select, and an audit probe may not insert — it would write a fabricated record into the trail this plugin exists to keep trustworthy. So the probe reads instead, on the primary key against a sentinel that no generated id can equal (toAuditRow writes runtime.uuid() there): the round trip exercises the connection and the table's existence while returning no rows, which is what keeps it cheap enough to run on a health interval.

A rejection means the client was reached for and did not answer — a dropped connection, a missing table, a revoked grant — all of which mean the next append will be lost.