guard(di): captive-dependency tripwires — scope validation + an actor field scan

Register row 50. Row 45 (fixed 9e769735) was a live captive dependency —
NotificationOutboxActor cached delivery adapters resolved from an actor-lifetime
IServiceScope, so MaxParallelDeliveries concurrent deliveries shared one EF
DbContext and central-b logged EF's "second operation was started on this context
instance" continuously. Actors take the ROOT IServiceProvider rather than typed
services, which is invisible to build-time analysis, so the bug class had no
mechanical guard at all. This adds both of the register's mitigations; neither
subsumes the other.

1. ValidateScopes + ValidateOnBuild in Development, on BOTH branches, via
   ServiceProviderValidation.Configure. WebApplication.CreateBuilder already sets
   both flags to IsDevelopment(), so on paper this restates a default — it is
   written out because that default is silent (a future move off CreateBuilder
   drops it with no diagnostic) and because this host carries three
   environment-ish signals (SCADABRIDGE_CONFIG, DOTNET_ENVIRONMENT,
   ASPNETCORE_ENVIRONMENT), so "is this node in Development" is not obvious at the
   call site. Production stays unvalidated deliberately: a validation failure is
   fail-closed, and CI now proves what a production node will not check.

   This surfaced two REAL latent violations on the SITE role — not captive
   dependencies but unconstructible descriptors, which fail ValidateOnBuild for
   the entire graph and are therefore what kept the site branch from being
   validatable at all (SiteHealthEndpointTests had pinned UseEnvironment
   ("Production") to work around exactly this):

     - ReconcileService (scoped, needs the central-only IDeploymentManagerRepository)
       moved out of the shared AddCommunication() into a new AddCentralCommunication().
     - AuditLogKpiSampleSource (scoped IKpiSampleSource, needs the central-only
       IAuditLogRepository) moved out of the shared AddAuditLog() into a new
       AddAuditLogCentralKpi().

   Both were registered on sites under the argument "harmless — only the central
   actor ever resolves it". True of the runtime, false of the container: a
   registration nothing can build is what stops the validator being usable, and it
   masks whatever real defect the validator would have found. Both are now
   central-only and SiteHealthEndpointTests boots the site branch validated again.

2. CaptiveDependencyGuard: a reflection scan over every actor class in the shipped
   assemblies (28 today; the reference graph is walked from the Host assembly
   because referenced assemblies load lazily). Fails on any instance field — auto-
   property backing fields included, they are ordinary private fields — typed as
   IServiceScope, as a DbContext, or as a service the REAL composition roots
   register Scoped. The scoped set is derived from the built Central and Site
   containers rather than hand-listed, so a lifetime change automatically re-scopes
   the check. IServiceProvider / IServiceScopeFactory fields are explicitly allowed:
   that IS the correct per-operation-scope pattern.

   No live violation exists — every actor opens a scope per operation. Two fields
   are allowlisted with their safety argument rather than exempted silently:
   AuditLogIngestActor._injectedRepository and SiteCallAuditActor._injectedRepository
   are scoped repository types assigned ONLY by explicitly test-mode constructors,
   null under production wiring (AkkaHostedService uses the IServiceProvider
   overload in both cases), and SiteCallAuditActor additionally wraps its injected
   instance in a SerializedRepository. The shape is one constructor call away from
   being row 45 again, so it is recorded, not dismissed.

Tests: 10 new. Six permanent self-tests of the guard, including positive controls
that reproduce the pre-row-45 shape (an actor caching a scoped service, an
IServiceScope, a DbContext, and a scoped auto-property) and a negative control for
the allowed root-provider pattern — a reflection guard that matches nothing passes
just as green as one that works. Plus an actor-count floor with cross-assembly
spot-checks, an allowlist-staleness test that fails any entry no longer matching a
flagged field, and the two per-role scans. Verified non-vacuous by emptying the
allowlist: the Central scan then names both real fields. Two composition-root
build tests force both validation flags on per role regardless of environment.

Doc: REQ-HOST-11 in Component-Host.md records all three rules and their guards.

src/ZB.MOM.WW.ScadaBridge.Communication/ServiceCollectionExtensions.cs

@@ -42,9 +42,33 @@ public static class ServiceCollectionExtensions
         services.AddSingleton<SiteAlarmLiveCacheService>();
         services.AddSingleton<ISiteAlarmLiveCache>(sp => sp.GetRequiredService<SiteAlarmLiveCacheService>());
 
+        return services;
+    }
+
+    /// <summary>
+    /// Registers the communication services that only a CENTRAL node can construct.
+    /// Call alongside <see cref="AddCommunication"/> from the Central composition root only.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <see cref="ReconcileService"/> is scoped and takes <c>IDeploymentManagerRepository</c> —
+    /// an EF repository registered by <c>AddConfigurationDatabase</c>, which only central calls.
+    /// It used to live in the shared <see cref="AddCommunication"/> on the argument that it was
+    /// "harmless on site hosts: only the central actor ever resolves it". That is true of the
+    /// runtime behaviour but not of the container: the registration was UNCONSTRUCTIBLE on a
+    /// site node, so <c>ValidateOnBuild</c> failed the whole site graph and the site branch
+    /// could not have scope validation turned on at all (deferred register row 50). A
+    /// registration nothing can ever build is not harmless — it is the thing that stops the
+    /// validator from being usable, and it hides whatever real defect the validator would
+    /// otherwise have found.
+    /// </para>
+    /// </remarks>
+    /// <param name="services">The DI service collection to register services into.</param>
+    /// <returns>The same <see cref="IServiceCollection"/> to allow chaining.</returns>
+    public static IServiceCollection AddCentralCommunication(this IServiceCollection services)
+    {
         // Startup reconciliation handler — scoped (holds scoped repositories), resolved
-        // per-request by CentralCommunicationActor inside a DI scope. Harmless on site
-        // hosts: only the central actor ever resolves it.
+        // per-request by CentralCommunicationActor inside a DI scope.
         services.AddScoped<ReconcileService>();
 
         return services;