feat(scripting): batch submit, exact per-item deadlines, scripted-alarm seam on the out-of-process runner (lmxopcua#780)

- IScriptRunner.RunBatch: one EvalBatch frame per worker for every evaluation ready to run; per-item, streamed results.
  The default (InProcessScriptRunner) is RunAsync per item. Used by the Calculation pump (dequeue all, split at a
  repeated tag, publish in dequeue order), the VirtualTag seam (ScriptBatchCoalescer, no timer) and the scripted-alarm
  engine (whole dirty set). In process the pump and the engine stay one at a time, unchanged.
- Exact per-item deadlines: the worker hands work to an idle evaluation thread or defers it (EvalResults
  deferred_eval_ids); the host stops that run's clock and restarts T then G when it starts (started_eval_ids). A run
  queued behind a runaway is neither timed out nor struck and is a victim, not the culprit, at the kill.
- Scripted-alarm seam behind Scripting:Runner:Seams; unset Seams now means VirtualTag + Calculation, so alarms run out of
  process only when listed. Load still compiles each predicate (to PE bytes only) so a broken one fails the load; passes
  batch and apply in the serial order under the gate. Script faults freeze the condition BadInternalError; runner faults
  freeze it BadResourceUnavailable and re-evaluate on recovery; a dead worker never clears an alarm. IScriptRunnerProvider
  carries the runner to DriverHostActor.
- Perf harness: batch throughput (RunBatch vs RunAsync x n) and alarm-pass latency (in process / batched / serial);
  design §12.3 records macOS + windev. On windev the serial out-of-process alarm pass misses 250 ms from ~500 alarms;
  batched p99 <= 53 ms at 1,000.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docs/ScriptEditor.md

@@ -212,10 +212,12 @@ scripted-alarm predicates) runs scripts through the shared `ScriptRunGuard`:
   run returns, so a run that OOMs the process first is not stopped — that needs an
   out-of-process runner (→ #750).
 - **Out of process (opt-in, lmxopcua#780).** `Scripting:Runner=OutOfProcess` moves the
-  virtual-tag and Calculation seams' compiled runs into `ScriptWorker` processes, where a
+  virtual-tag and Calculation seams' compiled runs — and the scripted-alarm predicates,
+  when `Scripting:Runner:Seams` lists `ScriptedAlarm` — into `ScriptWorker` processes, where a
   run past `T + Scripting:Worker:HardGrace` is stopped by killing its worker and an OOM
   kills a worker instead of the server. A run whose worker died under it reads
-  `BadResourceUnavailable`. See `docs/VirtualTags.md` §"Out-of-process runner".
+  `BadResourceUnavailable` (an alarm is frozen with that annotation, never cleared). See
+  `docs/VirtualTags.md` §"Out-of-process runner".
 - **Recursion.** Unbounded recursion fails the script with
   `ScriptStackExhaustedException` (Bad, script log) instead of overflowing the
   stack, which would terminate the whole server. The runtime compile inserts a