Resolve all 33 medium-severity architecture review findings

Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.

Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.

Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.

Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.

Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.

Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.

Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.

src/ZB.MOM.WW.ScadaBridge.Host/CentralListenerIsolation.cs

@@ -0,0 +1,25 @@
+using Grpc.AspNetCore.Server;
+
+namespace ZB.MOM.WW.ScadaBridge.Host;
+
+/// <summary>Assigns endpoints to actual local sockets rather than caller-controlled authority headers.</summary>
+public static class CentralListenerIsolation
+{
+    /// <summary>Runs after routing and before authentication or endpoint dispatch.</summary>
+    public static IApplicationBuilder UseCentralListenerIsolation(this IApplicationBuilder app,
+        int grpcPort, int? metricsPort, IReadOnlyCollection<int> httpPorts)
+        => app.Use(async (context, next) =>
+        {
+            var port = context.Connection.LocalPort;
+            var grpc = context.GetEndpoint()?.Metadata.GetMetadata<GrpcMethodMetadata>() is not null;
+            var dedicatedMetrics = metricsPort == port && port != grpcPort && !httpPorts.Contains(port);
+            var metricsOrHealth = context.Request.Path == "/metrics" || context.Request.Path == "/healthz"
+                || context.Request.Path == "/health/ready" || context.Request.Path == "/health/active";
+            if ((port == grpcPort) != grpc || (dedicatedMetrics && !metricsOrHealth))
+            {
+                context.Response.StatusCode = StatusCodes.Status404NotFound;
+                return;
+            }
+            await next(context);
+        });
+}

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -678,6 +678,7 @@ try
 
         app.UseWebSockets();
         app.UseRouting();
+        app.UseCentralListenerIsolation(centralGrpcPort, centralMetricsPort, httpPorts);
         app.UseAuthentication();
         app.UseAuthorization();
         app.UseAntiforgery();

src/ZB.MOM.WW.ScadaBridge.Host/ZB.MOM.WW.ScadaBridge.Host.csproj

@@ -75,4 +75,5 @@
     <ProjectReference Include="../ZB.MOM.WW.ScadaBridge.ManagementService/ZB.MOM.WW.ScadaBridge.ManagementService.csproj" />
   </ItemGroup>
 
+<ItemGroup><ProjectReference Include="../ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker/ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker.csproj" /></ItemGroup>
 </Project>