feat(#23): elevate connection-binding completeness to a deploy-gating Error (M2.8)

Pre-deployment validation only WARNED when a data-sourced attribute had no
connection binding, so an instance with unresolved bindings still passed IsValid
and could deploy. There was also no check that a binding resolves to a connection
that actually exists at the target site.

- ValidationService.Validate gains an opt-in `enforceConnectionBindings` flag
  (default false) plus a `siteConnectionNames` set. Default-false keeps the
  template DESIGN-TIME path (ManagementActor.HandleValidateTemplate) non-blocking,
  since bindings are legitimately set later at instance/deploy time. The DEPLOY
  path (FlatteningPipeline) opts in (true) so:
    * a data-sourced attribute with no binding is now a deploy-gating Error;
    * a binding to a connection that does not exist on the target site is an Error.
  Static (non-data-sourced) attributes are never flagged.
- FlatteningPipeline computes the site-connection-names set from the loaded site
  data connections (mirroring M2.1's alarmCapableConnectionNames) and threads it in.
- Tests: TemplateEngine.Tests covers design-time warning / deploy-time error /
  static-ok / exists-at-site / non-existent-connection. New
  FlatteningPipelineConnectionBindingTests proves the deploy path enforces it.

Mark M2.7 + M2.8 completed in the plan task tracker.

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/FlatteningPipeline.cs

@@ -127,9 +127,26 @@ public class FlatteningPipeline : IFlatteningPipeline
             .Select(c => c.Name)
             .ToHashSet(StringComparer.Ordinal);
 
-        // Validate
+        // M2.8 (#23): the set of data-connection names that actually exist on the
+        // target site, used to verify each bound connection resolves to a real site
+        // connection. Same StringComparer.Ordinal as the rest of the binding-resolution
+        // path (connection names are matched as-authored throughout the pipeline).
+        var siteConnectionNames = dataConnections.Values
+            .Select(c => c.Name)
+            .ToHashSet(StringComparer.Ordinal);
+
+        // Validate. This is the deploy-gating path, so connection-binding completeness
+        // is enforced as an Error (enforceConnectionBindings: true): a data-sourced
+        // attribute with no binding — or one bound to a connection that no longer exists
+        // on the site — blocks the deployment. (The template DESIGN-TIME validate path in
+        // ManagementActor leaves this non-blocking by NOT enforcing, since bindings are
+        // set later at instance/deploy time.)
         var validation = _validationService.Validate(
-            config, resolvedSharedScripts, alarmCapableConnectionNames);
+            config,
+            resolvedSharedScripts,
+            alarmCapableConnectionNames,
+            enforceConnectionBindings: true,
+            siteConnectionNames: siteConnectionNames);
 
         // Compute revision hash
         var hash = _revisionHashService.ComputeHash(config);