docs+test(site-runtime): Lever 1 final-review polish — document that the Good reset does not release an in-flight request and that the guard is inert once interval ≥ ceiling; FlappingGood asserts the retry landed during the burst instead of timing Thread.Sleep; NativeAlarmActor (same unguarded amplifier) + cancel-race residue recorded as follow-ups

Claude-Session: https://claude.ai/code/session_019ZxXT5sxZs5XrtdwYzJDPV

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptions.cs

@@ -137,6 +137,15 @@ public class SiteRuntimeOptions
     /// interval on top of the one it is still processing. Once older than this the
     /// reply is presumed lost and a new request is allowed. Size it above the
     /// gateway's per-command deadline (MxGateway default 30 s). Default: 45000ms.
+    /// <para>
+    /// Two consequences worth knowing: (1) the guard binds only while the retry interval
+    /// is shorter than this ceiling — once the backoff has grown past it every tick is
+    /// already older than the ceiling, so the interval itself becomes the rate limit
+    /// (steady state at the defaults: one re-send per 60 s); (2) a connection returning to
+    /// Good resets the backoff but does NOT release an outstanding request — that request
+    /// still owns the connection until the ceiling, so the Good reset shortens the wait
+    /// only when nothing is in flight.
+    /// </para>
     /// </summary>
     public int TagSubscribeInFlightCeilingMs { get; set; } = 45000;