Resolve all high-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SiteCallAuditRepository.cs

@@ -181,8 +181,16 @@ VALUES
      @LastError, @HttpStatus, @CreatedAtUtc, @UpdatedAtUtc, @TerminalAtUtc, @IngestedAtUtc);";
 
     // Leg 2 of the upsert: the monotonic guard. Also re-run standalone from the
-    // duplicate-key catch, which is why it lives in its own constant.
+    // duplicate-key catch, which is why it lives in its own constant. Ownership
+    // is checked here as well as in the UPDATE predicate: an insert-race loser
+    // must not advance another site's operation. Throwing rolls back the paired
+    // audit/operational ingest transaction instead of acknowledging forged state.
     private const string MonotonicUpdateSql = @"
+IF EXISTS (SELECT 1 FROM dbo.SiteCalls
+           WHERE TrackedOperationId = @Id
+             AND SourceSite COLLATE Latin1_General_100_BIN2 <> @SourceSite COLLATE Latin1_General_100_BIN2)
+    THROW 51001, 'Site-call operation ownership denied.', 1;
+
 UPDATE dbo.SiteCalls
 SET Status = @Status,
     RetryCount = @RetryCount,
@@ -193,6 +201,7 @@ SET Status = @Status,
     IngestedAtUtc = @IngestedAtUtc,
     SourceNode = COALESCE(@SourceNode, SourceNode)
 WHERE TrackedOperationId = @Id
+  AND SourceSite COLLATE Latin1_General_100_BIN2 = @SourceSite COLLATE Latin1_General_100_BIN2
   AND ( @Rank > (CASE Status
       WHEN 'Submitted' THEN 0
       WHEN 'Forwarded' THEN 1