fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardService.cs

@@ -163,6 +163,16 @@ public class StoreAndForwardService
     /// </summary>
     private int _queueDepthProviderRegistered;
 
+    /// <summary>
+    /// StoreAndForward-025: the exact provider delegate this instance registered with
+    /// the process-global <see cref="ScadaBridgeTelemetry"/> gauge slot, retained so
+    /// <see cref="StopAsync"/> can deregister it by identity (compare-and-clear). Holding
+    /// the same reference both registers and clears the slot; the identity check ensures a
+    /// late stop of this instance cannot clear a newer instance's provider. Null until
+    /// <see cref="StartAsync"/> registers.
+    /// </summary>
+    private Func<long>? _queueDepthProvider;
+
     /// <summary>
     /// WP-10: Delivery handler delegate. The return value / exception is interpreted
     /// the same way on both the immediate-delivery path (<see cref="EnqueueAsync"/>)
@@ -347,7 +357,12 @@ public class StoreAndForwardService
         if (Interlocked.CompareExchange(ref _queueDepthProviderRegistered, 1, 0) == 0)
         {
             Interlocked.Add(ref _bufferedCount, pending);
-            ScadaBridgeTelemetry.SetQueueDepthProvider(() => Interlocked.Read(ref _bufferedCount));
+            // StoreAndForward-025: retain the exact delegate so StopAsync can
+            // deregister it by identity (compare-and-clear) without stomping a
+            // newer instance that may have re-registered into the global slot.
+            var provider = (Func<long>)(() => Interlocked.Read(ref _bufferedCount));
+            _queueDepthProvider = provider;
+            ScadaBridgeTelemetry.SetQueueDepthProvider(provider);
         }
 
         _retryTimer = new Timer(
@@ -380,6 +395,15 @@ public class StoreAndForwardService
     /// DI container ran its own shutdown. We now await the captured sweep task
     /// (with a bounded <see cref="SweepShutdownWaitTimeout"/> so a hung
     /// dependency cannot block host shutdown indefinitely) before returning.
+    ///
+    /// StoreAndForward-025: after the timer is disposed and the in-flight sweep has
+    /// drained, the queue-depth provider this instance registered with the process-global
+    /// <see cref="ScadaBridgeTelemetry"/> gauge is deregistered by identity (compare-and-
+    /// clear) — otherwise a stopped service would report a frozen depth forever and the
+    /// provider closure would pin this dead instance for the process lifetime. The clear is
+    /// identity-checked so a newer instance that already re-registered the global slot is
+    /// not stomped, and <see cref="_queueDepthProviderRegistered"/> is reset so a later
+    /// <see cref="StartAsync"/> on this instance re-registers cleanly.
     /// </summary>
     /// <returns>A task representing the asynchronous stop operation.</returns>
     public async Task StopAsync()
@@ -393,35 +417,46 @@ public class StoreAndForwardService
         }
 
         var inflight = Volatile.Read(ref _sweepTask);
-        if (inflight is null || inflight.IsCompleted)
+        if (inflight is not null && !inflight.IsCompleted)
         {
-            return;
+            try
+            {
+                // WaitAsync with a finite timeout: a hung delivery handler /
+                // storage call cannot block host shutdown indefinitely. On timeout
+                // the sweep keeps running but the host is free to proceed with
+                // disposal — preferred to never returning.
+                await inflight.WaitAsync(SweepShutdownWaitTimeout).ConfigureAwait(false);
+            }
+            catch (TimeoutException)
+            {
+                _logger.LogWarning(
+                    "Store-and-forward retry sweep did not finish within {Timeout}; " +
+                    "shutdown is proceeding while the sweep is still in-flight",
+                    SweepShutdownWaitTimeout);
+            }
+            catch (Exception ex)
+            {
+                // The sweep itself already logs at Error on failure (see
+                // RetryPendingMessagesAsync's catch); we only log here so a
+                // surprise fault during shutdown is still visible. Swallow so the
+                // host's shutdown sequence can continue regardless.
+                _logger.LogWarning(ex,
+                    "Store-and-forward retry sweep faulted during shutdown wait");
+            }
         }
 
-        try
+        // StoreAndForward-025: release the process-global queue-depth gauge provider so a
+        // stopped service stops reporting a frozen depth and the closure no longer pins
+        // this dead instance. Identity-checked (compare-and-clear) so a successor
+        // instance's provider is left intact; reset the one-time guard so a later
+        // StartAsync re-registers.
+        var provider = _queueDepthProvider;
+        if (provider is not null)
         {
-            // WaitAsync with a finite timeout: a hung delivery handler /
-            // storage call cannot block host shutdown indefinitely. On timeout
-            // the sweep keeps running but the host is free to proceed with
-            // disposal — preferred to never returning.
-            await inflight.WaitAsync(SweepShutdownWaitTimeout).ConfigureAwait(false);
-        }
-        catch (TimeoutException)
-        {
-            _logger.LogWarning(
-                "Store-and-forward retry sweep did not finish within {Timeout}; " +
-                "shutdown is proceeding while the sweep is still in-flight",
-                SweepShutdownWaitTimeout);
-        }
-        catch (Exception ex)
-        {
-            // The sweep itself already logs at Error on failure (see
-            // RetryPendingMessagesAsync's catch); we only log here so a
-            // surprise fault during shutdown is still visible. Swallow so the
-            // host's shutdown sequence can continue regardless.
-            _logger.LogWarning(ex,
-                "Store-and-forward retry sweep faulted during shutdown wait");
+            ScadaBridgeTelemetry.ClearQueueDepthProvider(provider);
+            _queueDepthProvider = null;
         }
+        Interlocked.Exchange(ref _queueDepthProviderRegistered, 0);
     }
 
     /// <summary>