fix(concurrency/lifetime): close Theme 5 — 10 concurrency / DI / scope findings

Concurrency hazards, DI lifetime hygiene, and one verify-only confirmation
across 8 modules. Highlights:

Concurrency:
- CentralUI-030: SandboxConsoleCapture writes routed through WriteSynchronized
  locking on the captured StringWriter — intra-script Task fan-out can no
  longer corrupt the per-call buffer.
- Commons-021: ExternalCallResult.Response now backed by Lazy<dynamic?>
  (ExecutionAndPublication) — no more benign double-parse race.
- CD-017: DeploymentManagerRepository.DeleteDeploymentRecordAsync now takes
  an expected RowVersion and seeds entry.OriginalValues so EF emits
  DELETE ... WHERE Id=@id AND RowVersion=@prior; stale RowVersion now
  throws DbUpdateConcurrencyException instead of silent overwrite.
- Transport-009: AuditCorrelationContext.BundleImportId backed by
  AsyncLocal<Guid?> so concurrent imports get per-logical-call isolation
  (was a scoped instance shared via AuditService across runs).

DI / lifetime:
- AuditLog-003: All 3 AuditLog actor handlers switched to CreateAsyncScope
  + await using — async EF disposal no longer swallowed.
- AuditLog-007: INodeIdentityProvider resolution standardised on
  GetRequiredService<>() (was mixed with GetService<>()).
- AuditLog-011: AddAuditLogHealthMetricsBridge guarded by sentinel
  descriptor check — calling twice no longer double-registers the hosted
  service.

Shutdown / supervision:
- SiteCallAudit-002: AkkaHostedService adds a CoordinatedShutdown
  cluster-leave task (drain-site-call-audit-singleton) that issues a
  bounded GracefulStop(10s) so failover waits for in-flight upserts.

Registration safety:
- NS-020: AkkaHostedService now guards NotificationForwarder S&F
  registration with _notificationDeliveryHandlerRegistered + throws
  InvalidOperationException on double-register to make the regression loud.

VERIFY-only closures:
- NotifOutbox-005: Confirmed already closed by CD-015 fix (ac96b83) —
  NotificationOutboxRepository.InsertIfNotExistsAsync uses the same
  raw-SQL IF NOT EXISTS + 2601/2627 swallow pattern; race eliminated.

5+ new regression tests (CentralUI sandbox WhenAll, ExternalCallResult
64-reader Barrier, AuditLog DI idempotency, RowVersion stale-throw,
SiteCallAudit-002 shutdown drain). Build clean; affected suites all green.
README regenerated: 65 open (was 75).

src/ScadaLink.AuditLog/Central/SiteAuditReconciliationActor.cs

@@ -195,44 +195,38 @@ public class SiteAuditReconciliationActor : ReceiveActor
             return;
         }
 
-        IServiceScope? scope = null;
+        // AuditLog-003: use CreateAsyncScope + await using so scoped EF Core
+        // services (IAsyncDisposable DbContexts) dispose asynchronously
+        // without blocking on sync Dispose() of pending connection cleanup.
+        await using var scope = _services.CreateAsyncScope();
         IAuditLogRepository repository;
         try
         {
-            scope = _services.CreateScope();
             repository = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to resolve IAuditLogRepository for reconciliation tick.");
-            scope?.Dispose();
             return;
         }
 
-        try
+        foreach (var site in sites)
         {
-            foreach (var site in sites)
+            try
             {
-                try
-                {
-                    await PullSiteAsync(site, repository, eventStream).ConfigureAwait(false);
-                }
-                catch (Exception ex)
-                {
-                    // Catch-all per the failure-isolation invariant: one site's
-                    // fault must not sink the rest of the tick. The cursor for
-                    // the failing site is left at its previous value so the
-                    // next tick retries the same window.
-                    _logger.LogWarning(
-                        ex,
-                        "Reconciliation pull failed for site {SiteId}; other sites continue.",
-                        site.SiteId);
-                }
+                await PullSiteAsync(site, repository, eventStream).ConfigureAwait(false);
+            }
+            catch (Exception ex)
+            {
+                // Catch-all per the failure-isolation invariant: one site's
+                // fault must not sink the rest of the tick. The cursor for
+                // the failing site is left at its previous value so the
+                // next tick retries the same window.
+                _logger.LogWarning(
+                    ex,
+                    "Reconciliation pull failed for site {SiteId}; other sites continue.",
+                    site.SiteId);
             }
-        }
-        finally
-        {
-            scope.Dispose();
         }
     }