fix(review): remediate re-review findings — DCL-029/InboundAPI-031/SiteRuntime-032/StoreAndForward-028 + Low doc/test

Fixes the 8 findings from the 2026-06-24 re-review (commit c42bb485), with a
regression test per Medium finding:

- DataConnectionLayer-029 (Med): HandleAlarmSubscribeCompleted now mirrors the
  tag-path re-check — if a feed is already stored for the source, release the
  redundant just-created subscription instead of overwriting + leaking the first
  one (the double-subscribe window DCL-023 reopened). +regression test.
- InboundAPI-031 (Med): remove WaitForAttribute's local 5s grace backstop (tighter
  than the CommunicationService Ask's timeout+IntegrationTimeout round-trip budget,
  so a slow-but-valid timed-out 'false' got cancelled into a 500). Link only the
  client-abort + explicit caller tokens; the lower layer owns the backstop. +test.
- SiteRuntime-032 (Med): derive the deployed count from an authoritative set of
  deployed config names (HashSet) instead of a map-presence-gated int, so deleting
  a DISABLED instance decrements correctly (SiteRuntime-029's gate leaked it).
  +deploy->disable->delete regression test.
- StoreAndForward-028 (Med): reset _bufferedCount in StopAsync alongside the
  register-guard so a same-instance Stop->Start re-seeds from a clean base (no ~2N
  gauge double-count). +restart regression test.
- AuditLog-017 (Low): test the OnIngestAsync scope-resolution guard (actor survives,
  replies empty, counts the failure) — no longer unpinned.
- CentralUI-037 / ScriptAnalysis-009 / SiteRuntime-033 (Low): doc-comment + spec
  fixes (Database-throws in the inbound sandbox; baseReferences param wording;
  native-alarm cap return-to-normal + per-condition NativeAlarmDropped eviction).

Targeted suites green: SiteRuntime 5, StoreAndForward 6, InboundAPI 31,
DataConnectionLayer 10, AuditLog 5, ScriptAnalysis 40, CentralUI ScriptAnalysis 52.

src/ZB.MOM.WW.ScadaBridge.ScriptAnalysis/ScriptTrustValidator.cs

@@ -104,11 +104,13 @@ public static class ScriptTrustValidator
         var violations = new SortedSet<string>(StringComparer.Ordinal);
 
         // ---- Pass 1: semantic symbol analysis (ported from SiteRuntime) ----
-        // Use the full trusted-platform reference set (not the minimal
-        // runtime-fidelity DefaultReferences) so EVERY type a script names
+        // Resolve against the supplied baseReferences so EVERY type a script names
         // resolves and is judged by its true namespace — closing the
         // forbidden-type-in-allowed-namespace blind spot (e.g. a bare
-        // System.Diagnostics.Process via `using System.Diagnostics;`).
+        // System.Diagnostics.Process via `using System.Diagnostics;`). The public
+        // entry point passes the full trusted-platform reference set; a caller on the
+        // degraded/test path may instead pass the minimal anchor-enriched fallback
+        // (BuildMinimalFallbackReferences()).
         var references = baseReferences.ToList();
         if (extraReferences != null)
             references.AddRange(extraReferences);