fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Actors/InstanceActor.cs

@@ -12,6 +12,7 @@ using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening;
 using ZB.MOM.WW.ScadaBridge.HealthMonitoring;
 using ZB.MOM.WW.ScadaBridge.SiteEventLogging;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Messages;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Scripts;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Streaming;
@@ -209,6 +210,12 @@ public class InstanceActor : ReceiveActor
         // WP-16: Handle alarm state changes from Alarm Actors (Tell pattern)
         Receive<AlarmStateChanged>(HandleAlarmStateChanged);
 
+        // SiteRuntime-027: a NativeAlarmActor tells us when one of its native
+        // conditions has left the mirror for good (snapshot-swap removal, retention
+        // drop, or cap eviction) so we can evict the stale _latestAlarmEvents key
+        // and not leak per-instance memory / bloat DebugView snapshots.
+        Receive<NativeAlarmDropped>(HandleNativeAlarmDropped);
+
         // WP-25: Debug view subscribe/unsubscribe (Ask pattern for snapshot)
         Receive<SubscribeDebugViewRequest>(HandleSubscribeDebugView);
         Receive<UnsubscribeDebugViewRequest>(HandleUnsubscribeDebugView);
@@ -1016,6 +1023,25 @@ public class InstanceActor : ReceiveActor
         _streamManager?.PublishAlarmStateChanged(changed);
     }
 
+    /// <summary>
+    /// SiteRuntime-027: evicts a native condition's key from the alarm-state maps once
+    /// the owning <see cref="NativeAlarmActor"/> has dropped it from its mirror (after
+    /// emitting the condition's final return-to-normal). Without this the
+    /// <c>_latestAlarmEvents</c> map grows without bound on a source that mints a fresh
+    /// <c>SourceReference</c> per occurrence (one permanently-retained Normal entry per
+    /// distinct condition the instance has ever seen), leaking per-instance memory and
+    /// bloating every DebugView snapshot.
+    ///
+    /// Native-only by construction: the key is a native condition's <c>SourceReference</c>.
+    /// Computed-alarm keys (configuration-bounded) are never sent here and never removed.
+    /// </summary>
+    private void HandleNativeAlarmDropped(NativeAlarmDropped dropped)
+    {
+        _latestAlarmEvents.Remove(dropped.SourceReference);
+        _alarmStates.Remove(dropped.SourceReference);
+        _alarmTimestamps.Remove(dropped.SourceReference);
+    }
+
     /// <summary>
     /// WP-25: Debug view subscribe — returns snapshot and begins streaming.
     /// </summary>