fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.Commons/Observability/ScadaBridgeTelemetry.cs

@@ -91,4 +91,29 @@ public static class ScadaBridgeTelemetry
 
         Volatile.Write(ref _queueDepthProvider, provider);
     }
+
+    /// <summary>
+    /// Clears the StoreAndForward queue-depth provider, but only if the currently
+    /// registered provider is the exact <paramref name="provider"/> delegate passed in
+    /// (reference-equal compare-and-clear). This lets a StoreAndForward service deregister
+    /// its own provider on graceful stop without stomping a newer instance that already
+    /// re-registered into the process-global slot: if a late stop of the old instance
+    /// passes its (now-superseded) delegate, the identity check fails and the newer
+    /// provider is preserved. After a successful clear the gauge falls back to reporting 0.
+    /// Mirrors <see cref="SetQueueDepthProvider"/>'s signature and <see cref="Volatile"/>
+    /// access pattern.
+    /// </summary>
+    /// <param name="provider">The provider delegate to remove; ignored unless it is the
+    /// one currently registered.</param>
+    public static void ClearQueueDepthProvider(Func<long> provider)
+    {
+        if (provider is null)
+        {
+            return;
+        }
+
+        // Compare-and-clear: only null the slot when it still holds the caller's
+        // delegate, so a stale stop cannot clobber a successor's provider.
+        Interlocked.CompareExchange(ref _queueDepthProvider, null, provider);
+    }
 }

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Kpi/KpiSeriesBucketer.cs

@@ -16,8 +16,12 @@ public static class KpiSeriesBucketer
     /// Empty buckets are omitted — no gap-filling.
     /// </summary>
     /// <param name="raw">
-    ///   Input series, assumed to be sorted ascending by <see cref="KpiSeriesPoint.BucketStartUtc"/>.
-    ///   If not sorted, the point with the largest timestamp within each bucket is selected.
+    ///   Input series, which must be sorted ascending by <see cref="KpiSeriesPoint.BucketStartUtc"/>.
+    ///   For sorted input the last point in iteration order within a bucket is the one with the
+    ///   largest timestamp (the intended last-value-per-bucket result). For unsorted input the
+    ///   method still selects the last point in iteration order within each bucket — it does
+    ///   <em>not</em> pick the largest-timestamp point — so the result is well-defined but not
+    ///   the last-value semantics callers expect; pre-sort the series first.
     ///   If <c>null</c> or empty, an empty list is returned.
     /// </param>
     /// <param name="fromUtc">UTC start of the query window (inclusive).</param>
@@ -85,8 +89,12 @@ public static class KpiSeriesBucketer
             if (bucketIndex >= maxPoints)
                 bucketIndex = maxPoints - 1;
 
-            // Keep the point with the highest timestamp in this bucket
-            // (last-value semantics; if ties, keep first encountered — stable).
+            // Keep the last point in iteration order within this bucket. Because the stored
+            // candidate's BucketStartUtc is the bucket-START timestamp (not the raw point's
+            // capture time), the comparison below is true for essentially any in-bucket point,
+            // so each later-in-iteration point overwrites the previous one. For the ascending-
+            // sorted input this method requires, last-in-iteration IS the largest-timestamp
+            // point — i.e. last-value-per-bucket semantics.
             if (!occupied[bucketIndex] ||
                 point.BucketStartUtc > best[bucketIndex].BucketStartUtc)
             {