chore: low-severity sweep — import session cap, full compile-error lists, leaf-name-fallback validation warning

#05-T24. Three low-severity cleanups, each TDD'd:
- TransportOptions.MaxConcurrentImportSessions (8): BundleSessionStore.Open rejects
  a new session past the cap (evicting expired entries first), bounding the N×~200 MB
  decrypted-content footprint. Soft cap (count/add not atomic).
- ScriptCompiler.TryCompile now joins ALL forbidden-API violations / compile errors
  (string.Join instead of [0]) so an operator sees every problem at once; the T15
  verdict cache stores the joined string.
- SemanticValidator emits an advisory warning when a CallScript target resolves
  ONLY via the composed leaf-name fallback (dynamic child path, not statically
  verified) instead of silently accepting it.

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

tests/ZB.MOM.WW.ScadaBridge.Transport.Tests/Import/BundleSessionStoreTests.cs

@@ -29,6 +29,36 @@ public sealed class BundleSessionStoreTests
         Summary: new BundleSummary(0, 0, 0, 0, 0, 0, 0, 0),
         Contents: Array.Empty<ManifestContentEntry>());
 
+    [Fact]
+    public void Open_beyond_MaxConcurrentImportSessions_throws_and_removing_one_admits_a_new_session()
+    {
+        // #05-T24: the store bounds concurrently-open sessions (each pins a
+        // decrypted bundle in memory). The (cap+1)th Open is rejected; freeing a
+        // slot re-admits a new session.
+        var clock = new TestTimeProvider(DateTimeOffset.UtcNow);
+        var opts = Options();
+        var cap = opts.Value.MaxConcurrentImportSessions;
+        var sut = new BundleSessionStore(opts, clock);
+        var future = clock.GetUtcNow().AddMinutes(30);
+
+        var sessions = new List<BundleSession>();
+        for (var i = 0; i < cap; i++)
+        {
+            var s = SessionExpiringAt(future);
+            sut.Open(s);
+            sessions.Add(s);
+        }
+
+        var overflow = SessionExpiringAt(future);
+        var ex = Assert.Throws<InvalidOperationException>(() => sut.Open(overflow));
+        Assert.Contains("Too many concurrent import sessions", ex.Message, StringComparison.Ordinal);
+
+        // Free a slot → the previously-rejected session is admitted.
+        sut.Remove(sessions[0].SessionId);
+        sut.Open(overflow);
+        Assert.NotNull(sut.Get(overflow.SessionId));
+    }
+
     [Fact]
     public void Open_then_Get_returns_session()
     {