fix(deploy): wire native-alarm-source capability validation into flattening pipeline (#22)

FlatteningPipeline loaded data connections but never passed the alarm-capable
connection set to SemanticValidator, so the native-alarm-source capability check
(built but inert) never ran — a source bound to a non-alarm-capable connection
deployed silently. Compute the capable set (IAlarmSubscribableConnection: OPC UA
+ MxGateway) and thread it through ValidationService to SemanticValidator.

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/FlatteningPipeline.cs

@@ -1,4 +1,5 @@
 using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Protocol;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
 using ZB.MOM.WW.ScadaBridge.Commons.Types;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening;
@@ -111,8 +112,18 @@ public class FlatteningPipeline : IFlatteningPipeline
             ReturnDefinition = s.ReturnDefinition
         }).ToList();
 
+        // Compute the alarm-capable connection-name set so the semantic validator
+        // can gate native-alarm-source bindings. "Alarm-capable" matches the DCL
+        // runtime decision (DataConnectionActor: _adapter is IAlarmSubscribableConnection),
+        // mapped from the protocol string via the shared AlarmCapableProtocols helper.
+        var alarmCapableConnectionNames = dataConnections.Values
+            .Where(c => AlarmCapableProtocols.IsAlarmCapable(c.Protocol))
+            .Select(c => c.Name)
+            .ToHashSet(StringComparer.Ordinal);
+
         // Validate
-        var validation = _validationService.Validate(config, resolvedSharedScripts);
+        var validation = _validationService.Validate(
+            config, resolvedSharedScripts, alarmCapableConnectionNames);
 
         // Compute revision hash
         var hash = _revisionHashService.ComputeHash(config);