fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Actors/NativeAlarmActor.cs

@@ -8,6 +8,7 @@ using ZB.MOM.WW.ScadaBridge.Commons.Types.Alarms;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening;
 using ZB.MOM.WW.ScadaBridge.SiteEventLogging;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Messages;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 
 namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Actors;
@@ -204,6 +205,10 @@ public class NativeAlarmActor : ReceiveActor
             {
                 Emit(prior, prior.Condition with { Active = false });
                 PersistDelete(sourceRef);
+                // SiteRuntime-027: this condition is gone for good — tell the parent
+                // to evict its _latestAlarmEvents key so it does not retain a stale
+                // (Normal) entry forever.
+                NotifyParentDropped(sourceRef);
             }
         }
 
@@ -244,6 +249,9 @@ public class NativeAlarmActor : ReceiveActor
         {
             _alarms.Remove(t.SourceReference);
             PersistDelete(t.SourceReference);
+            // SiteRuntime-027: evict the parent's _latestAlarmEvents key for the
+            // now-resolved condition so it does not leak.
+            NotifyParentDropped(t.SourceReference);
         }
 
         EnforceCap();
@@ -289,19 +297,48 @@ public class NativeAlarmActor : ReceiveActor
         var overflow = _alarms.Values
             .OrderBy(a => a.TransitionTime)
             .Take(_alarms.Count - cap)
-            .Select(a => a.SourceReference)
             .ToList();
 
-        foreach (var sourceRef in overflow)
+        foreach (var evicted in overflow)
         {
+            var sourceRef = evicted.SourceReference;
+
+            // SiteRuntime-028: the sibling drop paths (ApplySnapshotSwap, the
+            // ApplyLiveTransition retention drop) always emit a return-to-normal
+            // before the condition leaves the mirror. EnforceCap previously dropped
+            // a condition whose last-emitted state could still be Active, with no
+            // compensating emit — so the Instance Actor (and central's stream / the
+            // operator Alarm Summary) kept showing it Active forever, a phantom
+            // stuck alarm the mirror could never clear. Emit the return-to-normal
+            // for any still-active evicted condition (mirroring ApplySnapshotSwap)
+            // before removing it.
+            if (evicted.Condition.Active)
+            {
+                Emit(evicted, evicted.Condition with { Active = false });
+            }
+
             _alarms.Remove(sourceRef);
             PersistDelete(sourceRef);
+            // SiteRuntime-027: this condition is gone for good — evict the parent's
+            // _latestAlarmEvents key so it does not retain a stale entry.
+            NotifyParentDropped(sourceRef);
             _logger.LogWarning(
                 "Native alarm cap {Cap} exceeded for {Source} on {Instance}; dropped oldest mirrored alarm {Ref}",
                 cap, _source.CanonicalName, _instanceName, sourceRef);
         }
     }
 
+    /// <summary>
+    /// SiteRuntime-027: signals the parent Instance Actor that a native condition has
+    /// left the mirror for good so it can evict the matching <c>_latestAlarmEvents</c>
+    /// key. Always sent AFTER the condition's final return-to-normal
+    /// <see cref="AlarmStateChanged"/> emit, so the stream still sees the clear.
+    /// </summary>
+    private void NotifyParentDropped(string sourceReference)
+    {
+        _instanceActor.Tell(new NativeAlarmDropped(sourceReference));
+    }
+
     /// <summary>
     /// Builds and tells the parent an enriched <see cref="AlarmStateChanged"/> for a condition.
     /// </summary>