fix(security): enforce template locks on native alarm source overrides at flatten and management-command level

Add IsLocked to ResolvedNativeAlarmSource; FlatteningService skips overrides on a
locked source (mirrors attribute/alarm lock rules); ManagementActor SetInstanceNativeAlarmSourceOverride
flattens the instance and rejects an override on a locked source (and rejects a
canonical name that does not resolve, preventing dangling overrides).

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

tests/ZB.MOM.WW.ScadaBridge.TemplateEngine.Tests/Flattening/FlatteningServiceTests.cs

@@ -789,6 +789,32 @@ public class FlatteningServiceTests
         Assert.Equal("Override", result.Value.NativeAlarmSources[0].Source);
     }
 
+    [Fact]
+    public void Flatten_LockedNativeAlarmSource_IgnoresInstanceOverride()
+    {
+        // #05-T13: a native alarm source locked at the template level must not be
+        // repointed by an instance override — the resolved source keeps the template
+        // values and its Source stays "Template" (mirrors attribute/alarm lock rules).
+        var template = CreateTemplate(1, "Base");
+        template.NativeAlarmSources.Add(new TemplateNativeAlarmSource("Pressure")
+        { ConnectionName = "Opc", SourceReference = "ns=2;s=DEFAULT", IsLocked = true });
+        var instance = CreateInstance();
+        instance.NativeAlarmSourceOverrides.Add(new InstanceNativeAlarmSourceOverride("Pressure")
+        { ConnectionNameOverride = "OtherOpc", SourceReferenceOverride = "ns=2;s=Tank07" });
+
+        var result = _sut.Flatten(instance, [template],
+            new Dictionary<int, IReadOnlyList<TemplateComposition>>(),
+            new Dictionary<int, IReadOnlyList<Template>>(),
+            new Dictionary<int, DataConnection>());
+
+        Assert.True(result.IsSuccess);
+        var src = result.Value.NativeAlarmSources[0];
+        Assert.Equal("Opc", src.ConnectionName);          // override ignored
+        Assert.Equal("ns=2;s=DEFAULT", src.SourceReference); // override ignored
+        Assert.Equal("Template", src.Source);
+        Assert.True(src.IsLocked);
+    }
+
     // ── MV-4: ElementDataType carried through flatten/override ────────────
 
     [Fact]