fix(central-ui): keep the instance picker disabled until the site's instances have loaded (typing raced the load and was wiped)

Both Flow Debugger and Debug View enable the shared InstancePicker as soon as
_selectedSiteId lands, but Blazor renders at the site-change handler's first
await — at which point the picker is still holding the PREVIOUS site's Areas /
Instances lists. Typing into the field in that window (an operator, or
Playwright's FillAsync, which waits only for "enabled") was silently lost: the
picker compares both lists by reference, so the freshly-assigned lists read as
"the site changed" and it clears the field text and closes the panel.

Both pages now hold an _instancesLoading flag across the whole load — set before
the first await, cleared in a finally so a fault or a site-scope refusal cannot
leave the picker disabled forever — and fold it into the picker's Disabled
expression. InstancePicker itself is unchanged.

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Deployment/FlowDebugger.razor

@@ -69,7 +69,7 @@
                        loaded once per site — the picker treats a new list as a site change. *@
                     <InstancePicker Areas="_areas" Instances="_instances"
                                     SelectedInstanceId="_selectedInstanceId" SelectedInstanceIdChanged="OnInstancePickedAsync"
-                                    Disabled="@(_running || _selectedSiteId == 0)"
+                                    Disabled="@(_running || _selectedSiteId == 0 || _instancesLoading)"
                                     Placeholder="Search instances…" DataTestPrefix="flow-instance" />
                 </div>
                 <div class="col-md-3">