fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Persistence/SiteStorageService.cs

@@ -623,6 +623,30 @@ public class SiteStorageService
 
     // ── WP-33: Notification List CRUD ──
 
+    /// <summary>
+    /// DeploymentManager-025 / SiteRuntime-031: notification delivery is central-only.
+    /// Sites store-and-forward notifications to the central cluster and never deliver
+    /// over SMTP, so notification lists and SMTP configuration must never live on a
+    /// site. This purges every row from the site-local <c>notification_lists</c> and
+    /// <c>smtp_configurations</c> tables, clearing any rows a prior (now-corrected)
+    /// build may have shipped — most importantly the plaintext SMTP password. It is
+    /// idempotent and is invoked on every artifact apply / deploy so existing exposure
+    /// is cleared, not just future writes. The tables themselves are retained (the
+    /// schema is harmless once empty); only their contents are removed.
+    /// </summary>
+    /// <returns>A task that completes when both tables have been emptied.</returns>
+    public async Task PurgeCentralOnlyNotificationConfigAsync()
+    {
+        await using var connection = new SqliteConnection(_connectionString);
+        await connection.OpenAsync();
+
+        await using var command = connection.CreateCommand();
+        command.CommandText = @"
+            DELETE FROM notification_lists;
+            DELETE FROM smtp_configurations;";
+        await command.ExecuteNonQueryAsync();
+    }
+
     /// <summary>
     /// Stores or updates a notification list.
     /// </summary>