fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.ScriptAnalysis/ScriptTrustValidator.cs

@@ -55,17 +55,42 @@ public static class ScriptTrustValidator
     /// </summary>
     /// <param name="code">The C# script source to analyse.</param>
     /// <param name="extraReferences">
-    /// Optional additional metadata references to add to
-    /// <see cref="ScriptTrustPolicy.DefaultReferences"/> for semantic
-    /// resolution — e.g. the compile-surface globals assembly so a script
-    /// referencing the API surface resolves cleanly. Forbidden references are
-    /// NOT added here (a script can't reach a forbidden API just because the
-    /// assembly is referenced; the deny-list still applies).
+    /// Optional additional metadata references to <b>widen symbol resolution</b>
+    /// for the semantic pass — e.g. the compile-surface globals assembly so a
+    /// script referencing the API surface resolves cleanly. Extra references can
+    /// ONLY improve resolution; they can NEVER whitelist a forbidden API. The
+    /// verdict is by resolved namespace/type against
+    /// <see cref="ScriptTrustPolicy.ForbiddenScopes"/>, so passing more
+    /// references — even the forbidden-API assemblies themselves — can only make
+    /// the verdict more accurate (more types resolve to their true namespace and
+    /// are judged), never produce a false allow. Callers therefore need not (and
+    /// cannot, for safety purposes) curate this set; the Central UI run gate
+    /// forwards its full compilation reference surface here precisely because
+    /// doing so is safe.
     /// </param>
     /// <returns>A list of trust-model violation messages; empty if the script is clean.</returns>
     public static IReadOnlyList<string> FindViolations(
         string code,
         IEnumerable<MetadataReference>? extraReferences = null)
+        => FindViolations(code, ScriptTrustPolicy.AnalysisReferences, extraReferences);
+
+    /// <summary>
+    /// Overload that runs the trust analysis against an explicit base reference
+    /// set instead of <see cref="ScriptTrustPolicy.AnalysisReferences"/>. The
+    /// public entry point above always uses the full analysis set; this overload
+    /// exists so tests can pin behaviour against the minimal TPA-fallback set
+    /// (<see cref="ScriptTrustPolicy.BuildMinimalFallbackReferences"/>) and prove
+    /// the degraded mode still catches the documented forbidden anchors
+    /// (ScriptAnalysis-001). The two passes are otherwise identical.
+    /// </summary>
+    /// <param name="code">The C# script source to analyse.</param>
+    /// <param name="baseReferences">The base reference set Pass 1 resolves against.</param>
+    /// <param name="extraReferences">Optional additional references that only widen resolution.</param>
+    /// <returns>A list of trust-model violation messages; empty if the script is clean.</returns>
+    public static IReadOnlyList<string> FindViolations(
+        string code,
+        IReadOnlyList<MetadataReference> baseReferences,
+        IEnumerable<MetadataReference>? extraReferences = null)
     {
         if (string.IsNullOrWhiteSpace(code))
             return Array.Empty<string>();
@@ -84,7 +109,7 @@ public static class ScriptTrustValidator
         // resolves and is judged by its true namespace — closing the
         // forbidden-type-in-allowed-namespace blind spot (e.g. a bare
         // System.Diagnostics.Process via `using System.Diagnostics;`).
-        var references = ScriptTrustPolicy.AnalysisReferences.ToList();
+        var references = baseReferences.ToList();
         if (extraReferences != null)
             references.AddRange(extraReferences);