feat(scripting): self-contained script worker publish, docker-dev drill, §8 perf harness (lmxopcua#780 P1)

- A self-contained Host publish (-r win-x64 --self-contained, the Windows installs) now publishes the
  ScriptWorker self-contained for the same RID into script-worker/. The launcher starts its apphost
  directly when runtimeconfig.json lists includedFrameworks. A framework-dependent worker (docker-dev)
  keeps running through the dotnet muxer.
- docker-dev/docker-compose.script-runner.yml: OutOfProcess for the central pair's VT + Calc seams.
  Live drill recorded in design §12.1 (runaway kill + quarantine, kill -9 recovery, open circuit
  with /health/ready still 200, metrics).
- ScriptRunnerPerfTests (Category=Perf, opt-in via OTOPCUA_SCRIPT_PERF=1): InProcess vs OutOfProcess
  at K=1/2/4. The accepted 5k evals/s/node gate passes on macOS and windev. The host-CPU, RSS and
  Windows latency budget misses are tracked as #789.
- Fix: the single-flight slot is released before the awaiting caller resumes. Before, a caller that
  started its next run right after the previous one returned could be refused with "previous
  evaluation still running", which the seams publish as Bad.
- Fix: the worker compiles on dedicated threads, not the thread pool. A burst of cold loads starved
  the heartbeat, and the host killed the shard (found on windev). Load-timeout queueing is #790.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docker-dev/README.md

@@ -160,6 +160,17 @@ and the script fails loudly saying so. A plain `docker compose up -d` also hides
 rig without the gate helping: `up -d` blocks on the `depends_on: service_healthy` conditions and
 returns ~30 s *after* Traefik starts, by which time the router table is long loaded.
 
+## Out-of-process script runner overlay
+
+`docker-compose.script-runner.yml` is an **optional overlay** (lmxopcua#780). It sets `Scripting:Runner=OutOfProcess` for the
+VirtualTag and Calculation seams on `central-1`/`central-2`, with a container-local `PeCacheDir`. The image must come from a branch
+that has the runner. Bring it up with
+`docker compose -f docker-dev/docker-compose.yml -f docker-dev/docker-compose.script-runner.yml up -d --no-deps central-1 central-2`.
+To go back to InProcess, run the same `up` with the base file alone.
+
+Note that `deploy.sh` reads its body from stdin whenever stdin is not a terminal. Run it as `./deploy.sh < /dev/null` from a
+script or a background job; otherwise curl waits on stdin forever.
+
 ## QuestDB historian overlay
 
 `docker-compose.questdb.yml` is an **optional overlay** (not part of the default rig) that adds one service, `questdb`

docker-dev/docker-compose.script-runner.yml

@@ -0,0 +1,25 @@
+# docker-dev/docker-compose.script-runner.yml — optional overlay: run the central pair's VirtualTag + Calculation
+# scripts OUT OF PROCESS (lmxopcua#780, Scripting:Runner=OutOfProcess). The scripted-alarm seam stays in process.
+#
+# Up (recreates only the two central nodes with the extra env; the image must be built from a branch that has the
+# runner, i.e. `docker compose -f docker-dev/docker-compose.yml build central-1` first):
+#   docker compose -f docker-dev/docker-compose.yml -f docker-dev/docker-compose.script-runner.yml up -d --no-deps central-1 central-2
+# Back to InProcess (the default and the rollback): re-run `up -d --no-deps central-1 central-2` with the base file alone.
+#
+# Watch it: `docker exec <node> ps -eo pid,args | grep ScriptWorker` lists the shard workers (they start on the first
+# compiled evaluation, not at boot); `/metrics` on :9000 carries otopcua_script_* (runner state, worker up/inflight,
+# eval duration, compile cache); `/health/ready` carries the `script-runner` entry (Degraded at worst, never 503).
+# PeCacheDir is container-local (/tmp), so a container recreate starts with a cold cache.
+x-script-runner-env: &script-runner-env
+  Scripting__Runner: "OutOfProcess"
+  Scripting__Runner__Seams__0: "VirtualTag"
+  Scripting__Runner__Seams__1: "Calculation"
+  Scripting__Worker__PeCacheDir: "/tmp/otopcua-pe-cache"
+
+services:
+  central-1:
+    environment:
+      <<: *script-runner-env
+  central-2:
+    environment:
+      <<: *script-runner-env