fix(m9/T24a): scope move-guard native-alarm scan to source-site templates (Ordinal); purpose-built include; add guard-4 + repo tests

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/ISiteRepository.cs

@@ -90,6 +90,18 @@ public interface ISiteRepository
     /// <returns>A task that resolves to the distinct referencing <see cref="Instance"/> entities (empty when none).</returns>
     Task<IReadOnlyList<Instance>> GetInstancesReferencingDataConnectionAsync(int dataConnectionId, CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Retrieves a site's instances with their
+    /// <see cref="Instance.NativeAlarmSourceOverrides"/> eagerly loaded. Purpose-built
+    /// for the move-data-connection guard, which must scan source-site instance
+    /// overrides for name-based connection references without paying the eager-load
+    /// cost on the hot-path <see cref="GetInstancesBySiteIdAsync"/>.
+    /// </summary>
+    /// <param name="siteId">The site primary key to filter by.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <returns>A task that resolves to the site's <see cref="Instance"/> entities with overrides loaded (empty when none).</returns>
+    Task<IReadOnlyList<Instance>> GetInstancesWithNativeAlarmOverridesBySiteIdAsync(int siteId, CancellationToken cancellationToken = default);
+
     /// <summary>Saves all pending changes to the database.</summary>
     /// <param name="cancellationToken">Cancellation token.</param>
     /// <returns>A task that resolves to the number of state entries written to the database.</returns>