fix(scriptanalysis): M3.6 — full-framework analysis refs close forbidden-type-in-allowed-ns blind spot; pin Process/Stopwatch; fix stale codec test; drop dead ContainsInCode

src/ZB.MOM.WW.ScadaBridge.ScriptAnalysis/ScriptTrustValidator.cs

@@ -79,7 +79,12 @@ public static class ScriptTrustValidator
         var violations = new SortedSet<string>(StringComparer.Ordinal);
 
         // ---- Pass 1: semantic symbol analysis (ported from SiteRuntime) ----
-        var references = ScriptTrustPolicy.DefaultReferences.ToList();
+        // Use the full trusted-platform reference set (not the minimal
+        // runtime-fidelity DefaultReferences) so EVERY type a script names
+        // resolves and is judged by its true namespace — closing the
+        // forbidden-type-in-allowed-namespace blind spot (e.g. a bare
+        // System.Diagnostics.Process via `using System.Diagnostics;`).
+        var references = ScriptTrustPolicy.AnalysisReferences.ToList();
         if (extraReferences != null)
             references.AddRange(extraReferences);