feat(scripts): read-only, allow-listed Files global for site scripts; Delmia test receiver parses recipe files

Script file access (design docs/plans/2026-09-28-script-file-access-design.md): Files.ReadTextAsync /
ReadLinesAsync / ExistsAsync on site ScriptGlobals (+ Instance.Files), backed by the site-singleton
ScriptFileReader. The one host-mediated exception to the System.IO ban - scripts still never name a
System.IO type. OFF by default: ScadaBridge:SiteRuntime:ScriptFileAccess:AllowedRoots (empty = every call
throws Disabled) + MaxFileBytes (1 MiB, validated 1..64 MiB, roots must be absolute). Guard: fully
qualified, no device paths / ADS, canonical path strictly inside a root (directory-boundary match), no
reparse point on the file or any directory below the root, size cap before and during the read.
Errors are one Commons type, ScriptFileAccessException(+ScriptFileAccessFailure); Commons.Types.Scripts
joins the default script imports on every surface so it binds by short name. Mirrored on
ScriptCompileSurface (CompileFiles, parity-pinned) and the Test Run sandbox (binds, refuses Disabled).
Inbound (central) scripts do not get it.

Rig: docker/recipes (sample RecipeValueName,RecipeValue files incl. an invalid one) bind-mounted
read-only at /app/recipes on both site-a nodes with AllowedRoots [/app/recipes]. The TestMesMachine
SimDelmiaRecipe simulator now reads + parses the downloaded file, converts each value to its recipe tag's
type and loads it all-or-nothing (14 new TestDelmiaReceiver attributes); verify-mes-test-machine.sh
group A covers accept / re-download / invalid lines / NotFound / OutsideAllowedRoots, VERIFY_GROUPS
selects groups (rig: AD).

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Scripts/ScriptRuntimeContext.cs

@@ -335,7 +335,8 @@ public class ScriptRuntimeContext
         bool isTraced = false,
         FlowTraceCollector? traceCollector = null,
         int maxLogLinesPerRun = 200,
-        ScriptLogger? sharedLog = null)
+        ScriptLogger? sharedLog = null,
+        IScriptFileReader? fileReader = null)
     {
         _instanceActor = instanceActor;
         _sharedScriptLibrary = sharedScriptLibrary;
@@ -368,6 +369,8 @@ public class ScriptRuntimeContext
         // WaitForAttribute (spec §4.3): default(CancellationToken) == None when
         // not threaded in — the WaitAsync Ask is then bounded only by its own timeout.
         _scriptTimeoutToken = scriptTimeoutToken;
+        // Script file access (design 2026-09-28): null when the host wired no reader — Files.* then throws Disabled.
+        _fileReader = fileReader;
         _isTraced = isTraced;
         _traceCollector = traceCollector;
         _traceSink = traceCollector is null ? null : Collect;
@@ -503,7 +506,9 @@ public class ScriptRuntimeContext
             // Step logs (design §5): the inline shared script is its own execution node for step
             // rows, but it SHARES this run's Log — one line cap and one anchor for the whole
             // inline chain, so its lines carry this run's ExecutionId.
-            sharedLog: Log);
+            sharedLog: Log,
+            // Script file access (design 2026-09-28): the inline shared script reads through the same host reader.
+            fileReader: _fileReader);
     }
 
     /// <summary>
@@ -1248,6 +1253,15 @@ public class ScriptRuntimeContext
     /// </summary>
     public AlarmsAccessor Alarms => _alarms ??= new(this);
 
+    private readonly IScriptFileReader? _fileReader;
+    private FilesAccessor? _files;
+
+    /// <summary>
+    /// Read-only access to files under the node's configured allowed roots (design 2026-09-28).
+    /// Bounded by this run's execution deadline. Off by default.
+    /// </summary>
+    public FilesAccessor Files => _files ??= new(_fileReader, _scriptTimeoutToken);
+
     /// <summary>
     /// Backing read for <see cref="AlarmsAccessor.CurrentAsync"/>: Asks THIS instance's
     /// Instance Actor for its retained alarm rows and projects them to