fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.TemplateEngine/Validation/SemanticValidator.cs

@@ -565,43 +565,6 @@ public class SemanticValidator
         return result;
     }
 
-    /// <summary>
-    /// Parses a parameter definitions JSON string (JSON Schema or legacy flat array) and returns the declared parameter names.
-    /// </summary>
-    /// <param name="parameterDefinitionsJson">JSON Schema or legacy flat-array string; null/empty returns an empty list.</param>
-    /// <returns>The list of parameter names declared in the definition.</returns>
-    internal static List<string> ParseParameterDefinitions(string? parameterDefinitionsJson)
-    {
-        if (string.IsNullOrWhiteSpace(parameterDefinitionsJson))
-            return [];
-
-        try
-        {
-            using var doc = JsonDocument.Parse(parameterDefinitionsJson);
-            // JSON Schema: { type:"object", properties:{ name:{...}, ... }, required:[...] }
-            if (doc.RootElement.ValueKind == JsonValueKind.Object)
-            {
-                if (doc.RootElement.TryGetProperty("properties", out var props)
-                    && props.ValueKind == JsonValueKind.Object)
-                {
-                    return props.EnumerateObject().Select(p => p.Name).ToList();
-                }
-            }
-            // Legacy flat form: [{ name, type, required? }]
-            else if (doc.RootElement.ValueKind == JsonValueKind.Array)
-            {
-                return doc.RootElement.EnumerateArray()
-                    .Select(e => e.TryGetProperty("type", out var t) ? t.GetString() ?? "unknown" : "unknown")
-                    .ToList();
-            }
-        }
-        catch (JsonException)
-        {
-        }
-
-        return [];
-    }
-
     /// <summary>
     /// Extracts call targets from script code by simple pattern matching.
     /// Looks for CallScript("name", ...) and CallShared("name", ...) patterns.