feat(mgmt): secured-write approve relays to site MxGateway write with CAS race guard (T14b)

src/ZB.MOM.WW.ScadaBridge.Communication/CommunicationService.cs

@@ -3,6 +3,7 @@ using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Audit;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.DataConnection;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.DebugView;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Deployment;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
@@ -417,6 +418,33 @@ public class CommunicationService
             envelope, _options.QueryTimeout, cancellationToken);
     }
 
+    // ── Secured Write Relay (M7 / T14b — approve → site MxGateway write) ──
+
+    /// <summary>
+    /// Relays a single tag write to the site's data connection and awaits the
+    /// outcome. Used by the secured-write (two-person) approve flow: once a
+    /// Verifier's approval wins the compare-and-swap, the central ManagementActor
+    /// calls this to execute the write against the site's MxGateway connection.
+    /// The request is the existing <see cref="WriteTagRequest"/>, already handled
+    /// site-side by <c>DataConnectionActor</c> (routed to the MxGateway adapter) —
+    /// no site-side change is required. The Ask is bounded by
+    /// <see cref="CommunicationOptions.QueryTimeout"/>, mirroring
+    /// <see cref="BrowseNodeAsync"/> and the other one-shot site queries.
+    /// </summary>
+    /// <param name="siteId">The target site identifier.</param>
+    /// <param name="request">The tag write request (correlation id + connection + tag + value + timestamp).</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The write response (success flag + optional error message).</returns>
+    public virtual Task<WriteTagResponse> WriteTagAsync(
+        string siteId,
+        WriteTagRequest request,
+        CancellationToken ct = default)
+    {
+        var envelope = new SiteEnvelope(siteId, request);
+        return GetActor().Ask<WriteTagResponse>(
+            envelope, _options.QueryTimeout, ct);
+    }
+
     // ── Pattern 8: Heartbeat (site→central, Tell) ──
     // Heartbeats are received by central, not sent. No method needed here.