fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.KpiHistory/KpiHistoryRecorderActor.cs

@@ -68,6 +68,19 @@ public class KpiHistoryRecorderActor : ReceiveActor, IWithTimers
     /// </summary>
     private CancellationTokenSource? _shutdownCts;
 
+    /// <summary>
+    /// In-flight guard for the sample loop. Set true at the start of a sample pass and cleared
+    /// when the pass's <see cref="SampleComplete"/> arrives. While true, further
+    /// <see cref="SampleTick"/>s are skipped so passes never overlap — Akka periodic timers
+    /// enqueue (not coalesce) missed ticks, so without this guard a pass running longer than
+    /// <see cref="KpiHistoryOptions.SampleInterval"/> (slow/recovering DB) would let each
+    /// subsequent tick spawn another concurrent pass, amplifying load on the struggling store
+    /// and double-writing samples for overlapping windows. Mirrors the
+    /// <see cref="ZB.MOM.WW.ScadaBridge.NotificationOutbox.NotificationOutboxActor"/> dispatch
+    /// in-flight guard the timer pattern is modelled on.
+    /// </summary>
+    private bool _sampleInFlight;
+
     /// <summary>Akka timer scheduler, assigned by the actor system via <see cref="IWithTimers"/>.</summary>
     public ITimerScheduler Timers { get; set; } = null!;
 
@@ -87,7 +100,7 @@ public class KpiHistoryRecorderActor : ReceiveActor, IWithTimers
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
 
         Receive<SampleTick>(_ => HandleSampleTick());
-        Receive<SampleComplete>(_ => { }); // best-effort: no actor state to reset on completion
+        Receive<SampleComplete>(_ => _sampleInFlight = false); // lower the in-flight guard (success or fault)
         Receive<PurgeTick>(_ => HandlePurgeTick());
         Receive<PurgeComplete>(_ => { }); // best-effort: no actor state to reset on completion
     }
@@ -135,19 +148,31 @@ public class KpiHistoryRecorderActor : ReceiveActor, IWithTimers
     }
 
     /// <summary>
-    /// Handles a sample tick: captures the shared <c>capturedAtUtc</c> instant on the actor
-    /// thread, then launches the asynchronous sampling pass off-thread and pipes a
-    /// completion back to <see cref="Self"/> so the mailbox is never blocked while sources
-    /// are collected and the batch is written.
+    /// Handles a sample tick. If a sample pass is already in flight the tick is skipped
+    /// (logged at debug) so passes never overlap; otherwise the in-flight guard is raised,
+    /// the shared <c>capturedAtUtc</c> instant is captured on the actor thread, and the
+    /// asynchronous sampling pass is launched off-thread with a <see cref="SampleComplete"/>
+    /// piped back to <see cref="Self"/> to lower the guard on the actor thread — so the
+    /// mailbox is never blocked while sources are collected and the batch is written.
     /// </summary>
     private void HandleSampleTick()
     {
+        if (_sampleInFlight)
+        {
+            // A prior pass is still awaiting its DB round-trip; coalesce this tick rather than
+            // piling a second concurrent pass onto a slow/recovering store.
+            _logger.LogDebug("KPI sample tick skipped — a sample pass is already in flight.");
+            return;
+        }
+
+        _sampleInFlight = true;
         var capturedAt = DateTime.UtcNow;
         var cancellationToken = _shutdownCts?.Token ?? CancellationToken.None;
 
         // RunSamplePass self-isolates its faults (it never throws), but the failure
         // projection is kept as a belt-and-braces guard so even a faulted task still
-        // produces a SampleComplete.
+        // produces a SampleComplete that lowers the in-flight guard — otherwise the loop
+        // would wedge permanently.
         RunSamplePass(capturedAt, cancellationToken).PipeTo(
             Self,
             success: () => SampleComplete.Instance,
@@ -282,7 +307,10 @@ public class KpiHistoryRecorderActor : ReceiveActor, IWithTimers
         private SampleTick() { }
     }
 
-    /// <summary>Piped-back completion of a sampling pass; lets the pass run off the actor thread.</summary>
+    /// <summary>
+    /// Piped-back completion of a sampling pass; lets the pass run off the actor thread and
+    /// lowers the <c>_sampleInFlight</c> guard on the actor thread (fires on success and fault).
+    /// </summary>
     internal sealed class SampleComplete
     {
         public static readonly SampleComplete Instance = new();