feat(site-runtime): InstanceActor trace arm stamps the device echo of a traced write; Trace rides on published changes

Flow Debugger (design 2026-09-05 §5.3): a traced SetStaticAttributeCommand on a data-sourced
attribute records (attribute → writer, expiry) for TraceArmWindowSeconds (new option,
default 30, validated > 0); the next DCL echo for that attribute is published with the
writer's SourceExecutionId + Trace whatever its value, and the arm is consumed once. Static
writes publish Trace directly. Untraced writes never arm (pinned).

Claude-Session: https://claude.ai/code/session_01GSLkkHKz9JrAtmJjmQK3cP

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptionsValidator.cs

@@ -108,5 +108,10 @@ public sealed class SiteRuntimeOptionsValidator : OptionsValidatorBase<SiteRunti
             "instance reconcile-sweep interval and a negative value throws inside the Akka timer. " +
             "0 disables the sweep, which reopens the replication-seeded-config and stale-revision " +
             "self-heals (deferred register rows 78 and 72).");
+
+        builder.RequireThat(options.TraceArmWindowSeconds > 0,
+            $"ScadaBridge:SiteRuntime:TraceArmWindowSeconds must be greater than 0 " +
+            $"(was {options.TraceArmWindowSeconds}); it is how long the Instance Actor waits for the " +
+            "device echo of a Flow Debugger traced write before the arm expires (design 2026-09-05 §5.3).");
     }
 }