feat(runtime): F8/F9 engine evaluator seams + DPS fan-out

VirtualTagActor and ScriptedAlarmActor now route through pluggable
evaluator interfaces and fan out to the cluster's live-tail topics
shipped in F15.3:

- IVirtualTagEvaluator + NullVirtualTagEvaluator in Commons.Engines.
  VirtualTagActor calls evaluator on every DependencyValueChanged,
  dedupes unchanged values, forwards EvaluationResult to its parent,
  and publishes ScriptLogEntry Warning to the script-logs DPS topic
  whenever the evaluator fails.

- IScriptedAlarmEvaluator + NullScriptedAlarmEvaluator. ScriptedAlarmActor
  takes an AlarmConfig (id/name/equipment-path/severity/predicate) and
  publishes both an AlarmTransitionEvent (alerts topic) and a
  ScriptLogEntry (script-logs topic) at every transition. Manual
  ConditionMet/Acknowledge/Cleared still flow through the same
  Transition() so callers without engine bindings still drive the
  state machine; the legacy single-string Props() overload routes
  through a default AlarmConfig.

The Null* defaults keep the actors safe when no engine is bound —
unconfigured nodes never spuriously alarm. Production binding to
Core.VirtualTags.VirtualTagEngine and Core.ScriptedAlarms is the
remaining residual (F8b/F9b — split in tasks JSON).

Tests: Runtime 34 -> 40 (+6):
- VirtualTagActorTests x3 (evaluator drives EvaluationResult,
  unchanged-value dedup, failure publishes Warning ScriptLogEntry)
- ScriptedAlarmActorTests x3 (engine threshold drives Activated +
  Cleared on alerts topic, manual Acknowledge attribution).

All 6 v2 test suites green: 126 tests passing.

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Engines/IScriptedAlarmEvaluator.cs

@@ -0,0 +1,30 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Engines;
+
+/// <summary>
+///     Abstraction over the scripted-alarm predicate engine. Production binds this to a
+///     wrapper around <c>ScriptedAlarmEngine</c> from <c>Core.ScriptedAlarms</c>; default
+///     binding is <see cref="NullScriptedAlarmEvaluator"/> which keeps the alarm in its
+///     current state (so an unconfigured node never spuriously alarms).
+/// </summary>
+public interface IScriptedAlarmEvaluator
+{
+    ScriptedAlarmEvalResult Evaluate(string alarmId, string predicate, IReadOnlyDictionary<string, object?> dependencies);
+}
+
+/// <summary>Result of one alarm-predicate evaluation. <c>Active</c> is only meaningful when
+/// <c>Success</c> is true; on failure the caller should keep the prior state and log Reason.</summary>
+public sealed record ScriptedAlarmEvalResult(bool Success, bool Active, string? Reason)
+{
+    public static ScriptedAlarmEvalResult Ok(bool active) => new(true, active, null);
+    public static ScriptedAlarmEvalResult Failure(string reason) => new(false, false, reason);
+}
+
+/// <summary>Default that always returns <c>Active = false, Success = true</c>. Safe no-op:
+/// no alarm fires when no real engine is bound.</summary>
+public sealed class NullScriptedAlarmEvaluator : IScriptedAlarmEvaluator
+{
+    public static readonly NullScriptedAlarmEvaluator Instance = new();
+    private NullScriptedAlarmEvaluator() { }
+    public ScriptedAlarmEvalResult Evaluate(string alarmId, string predicate, IReadOnlyDictionary<string, object?> dependencies)
+        => ScriptedAlarmEvalResult.Ok(active: false);
+}