test(host): serialize Central-boot fixtures to close env-var race

CentralDbTestEnvironment sets five process-wide environment variables, and
Program's AddEnvironmentVariables() reads them at an unpredictable point during
host boot. With xUnit collection parallelization on, one fixture's teardown
could clear a var mid-boot for a sibling. Since the secrets adoption (G-4)
three of those keys are ${secret:...} references that fail closed, turning a
previously benign empty value into a SecretNotFoundException that aborts the
boot — an intermittent CI failure.

Adds a HostBootCollection that serializes every fixture booting a real host
while depending on that shared state, folding in the narrower "ActorSystem"
collection so its members stay serialized with each other as before. Site-role
fixtures stay parallel: they call Configuration.Sources.Clear(), dropping the
env-var provider, so they cannot participate in the race.

CentralDbTestEnvironment now also fails fast if two instances are ever live at
once, making a regression (a fixture added outside the collection) deterministic
rather than intermittent — this is what surfaced the disposed-CTS defect fixed
in the previous commit. Fixture teardown is try/finally so a throwing host
teardown can no longer strand the vars for the rest of the run.

Cost: Host.Tests runs ~2m30s -> ~4m10s; the serialized Central-boot classes are
most of the assembly's parallelism.

Fixes: Gitea #15

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CentralDbTestEnvironment.cs

@@ -26,6 +26,14 @@ namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 /// the tokens entirely — so tests that boot the real <c>Program</c> pipeline do
 /// not need a seeded secrets store. All vars are restored on Dispose so tests
 /// stay isolated.
+///
+/// Every var below is <b>process-wide</b>, and the reader — <c>Program</c>'s
+/// <c>AddEnvironmentVariables()</c> — runs at an unpredictable point during host boot.
+/// Two live instances therefore cannot be allowed to overlap: one's Dispose would
+/// restore/clear a var while the other's boot is still reading it, and the fail-closed
+/// secrets expander turns that into a <c>SecretNotFoundException</c>. Serialization via
+/// <see cref="HostBootCollection"/> is what enforces the invariant; the overlap check in
+/// the constructor makes a regression fail deterministically instead of intermittently.
 /// </summary>
 internal sealed class CentralDbTestEnvironment : IDisposable
 {
@@ -64,8 +72,25 @@ internal sealed class CentralDbTestEnvironment : IDisposable
     private readonly string? _previousLdapPassword;
     private readonly string? _previousJwtSigningKey;
 
+    /// <summary>
+    /// Number of live instances. Only ever 0 or 1 while every consuming fixture is a
+    /// member of <see cref="HostBootCollection"/>; see the overlap check below.
+    /// </summary>
+    private static int _liveCount;
+
     public CentralDbTestEnvironment()
     {
+        if (Interlocked.Increment(ref _liveCount) != 1)
+        {
+            Interlocked.Decrement(ref _liveCount);
+            throw new InvalidOperationException(
+                $"Two {nameof(CentralDbTestEnvironment)} instances are live at once, so one fixture's " +
+                "teardown can clear the process-wide environment variables another fixture's host boot " +
+                $"is reading. Add the offending test class to the \"{HostBootCollection.Name}\" collection " +
+                $"([Collection({nameof(HostBootCollection)}.Name)]) so xUnit runs it sequentially with the " +
+                "other host-boot fixtures.");
+        }
+
         _previousConfig = Environment.GetEnvironmentVariable(ConfigKey);
         Environment.SetEnvironmentVariable(ConfigKey, ConfigurationDb);
 
@@ -89,5 +114,7 @@ internal sealed class CentralDbTestEnvironment : IDisposable
         Environment.SetEnvironmentVariable(PepperKey, _previousPepper);
         Environment.SetEnvironmentVariable(LdapPasswordKey, _previousLdapPassword);
         Environment.SetEnvironmentVariable(JwtSigningKeyKey, _previousJwtSigningKey);
+
+        Interlocked.Decrement(ref _liveCount);
     }
 }