fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

docs/requirements/Component-AuditLog.md

@@ -404,7 +404,7 @@ MS SQL for direct-write events). Unredacted secrets never persist.
   silently skipped (the global switch already covers them). The DELETE runs under
   `scadabridge_audit_purger` (the maintenance role); the append-only writer role
   is unaffected. Batch size is configurable via
-  `AuditLogPurge:ChannelPurgeBatchSize` (default 5000). Each channel override
+  `AuditLog:Purge:ChannelPurgeBatchSize` (default 5000). Each channel override
   runs in its own try/catch, mirroring the per-boundary error-isolation of the
   partition switch-out loop. Values are validated to be in
   `[30, RetentionDays]`; keys that are not a recognized `AuditChannel` enum name
@@ -498,12 +498,15 @@ the global window; `PerChannelRetentionDays` specifies per-channel windows that
 are strictly shorter — any channel whose override equals or exceeds the global
 value is silently ignored (the global partition switch-out already governs it).
 
-`AuditLogPurge` section controls the purge actor cadence and batch size:
+The nested `AuditLog:Purge` section controls the purge actor cadence and batch
+size:
 
 ```jsonc
-"AuditLogPurge": {
-  "IntervalHours": 24,
-  "ChannelPurgeBatchSize": 5000
+"AuditLog": {
+  "Purge": {
+    "IntervalHours": 24,
+    "ChannelPurgeBatchSize": 5000
+  }
 }
 ```