fix(deploymentmanager): bulk deploy skips Disabled + reconcile circuit-breaker + probe captures pre-flatten versions (arch-review 2026-08-19 P7-2 + P7-3 + P7-4)

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/DeploymentManagerOptions.cs

@@ -41,6 +41,25 @@ public class DeploymentManagerOptions
     /// </summary>
     public TimeSpan SiteDeploymentTimeoutPerInstance { get; set; } = TimeSpan.FromSeconds(120);
 
+    /// <summary>
+    /// Deadline applied to each query-before-redeploy reconciliation round-trip
+    /// inside a bulk <c>DeploySiteAsync</c> (the single-instance path keeps the
+    /// communication layer's own <c>QueryTimeout</c>).
+    ///
+    /// <para>
+    /// Phase 1 is strictly serial, so an unreachable site otherwise costs
+    /// <c>QueryTimeout</c> (30 s) PER INSTANCE before a single deploy is sent — for
+    /// a 500-instance site roughly four hours, far past the CLI's 5-minute bulk
+    /// deploy timeout, which then cancels and re-arms the identical cost on the next
+    /// attempt. Deliberately short (seconds): a reconcile that does not answer
+    /// promptly falls through to a normal deploy anyway, which is exactly what its
+    /// own timeout produces. Works together with the once-per-batch reachability
+    /// circuit-breaker, which skips the remaining reconciles after the first
+    /// timeout.
+    /// </para>
+    /// </summary>
+    public TimeSpan SiteDeploymentReconcileTimeout { get; set; } = TimeSpan.FromSeconds(5);
+
     /// <summary>
     /// Retention window for TERMINAL deployment records (<c>Success</c>,
     /// <c>Failed</c>). Deployments are insert-only — one row per attempt, forever —