feat(site-runtime): InstanceActor trace arm stamps the device echo of a traced write; Trace rides on published changes

Flow Debugger (design 2026-09-05 §5.3): a traced SetStaticAttributeCommand on a data-sourced
attribute records (attribute → writer, expiry) for TraceArmWindowSeconds (new option,
default 30, validated > 0); the next DCL echo for that attribute is published with the
writer's SourceExecutionId + Trace whatever its value, and the arm is consumed once. Static
writes publish Trace directly. Untraced writes never arm (pinned).

Claude-Session: https://claude.ai/code/session_01GSLkkHKz9JrAtmJjmQK3cP

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/SiteRuntimeOptionsValidatorTests.cs

@@ -136,6 +136,17 @@ public class SiteRuntimeOptionsValidatorTests
     }
 
     /// <summary>A zero cap would shed every trigger, silently disabling all scripts.</summary>
+    [Fact]
+    public void ZeroTraceArmWindowSeconds_IsRejected()
+    {
+        // Flow Debugger design 2026-09-05 §5.3: the arm window must be positive.
+        var result = Validate(new SiteRuntimeOptions { TraceArmWindowSeconds = 0 });
+
+        Assert.True(result.Failed);
+        Assert.Contains("TraceArmWindowSeconds", result.FailureMessage);
+        Assert.Equal(30, new SiteRuntimeOptions().TraceArmWindowSeconds);
+    }
+
     [Fact]
     public void ZeroMaxConcurrentRunsPerScript_IsRejected()
     {