feat(scripting): self-contained script worker publish, docker-dev drill, §8 perf harness (lmxopcua#780 P1)

- A self-contained Host publish (-r win-x64 --self-contained, the Windows installs) now publishes the
  ScriptWorker self-contained for the same RID into script-worker/. The launcher starts its apphost
  directly when runtimeconfig.json lists includedFrameworks. A framework-dependent worker (docker-dev)
  keeps running through the dotnet muxer.
- docker-dev/docker-compose.script-runner.yml: OutOfProcess for the central pair's VT + Calc seams.
  Live drill recorded in design §12.1 (runaway kill + quarantine, kill -9 recovery, open circuit
  with /health/ready still 200, metrics).
- ScriptRunnerPerfTests (Category=Perf, opt-in via OTOPCUA_SCRIPT_PERF=1): InProcess vs OutOfProcess
  at K=1/2/4. The accepted 5k evals/s/node gate passes on macOS and windev. The host-CPU, RSS and
  Windows latency budget misses are tracked as #789.
- Fix: the single-flight slot is released before the awaiting caller resumes. Before, a caller that
  started its next run right after the previous one returned could be refused with "previous
  evaluation still running", which the seams publish as Bad.
- Fix: the worker compiles on dedicated threads, not the thread pool. A burst of cold loads starved
  the heartbeat, and the host killed the shard (found on windev). Load-timeout queueing is #790.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docker-dev/README.md

@@ -160,6 +160,17 @@ and the script fails loudly saying so. A plain `docker compose up -d` also hides
 rig without the gate helping: `up -d` blocks on the `depends_on: service_healthy` conditions and
 returns ~30 s *after* Traefik starts, by which time the router table is long loaded.
 
+## Out-of-process script runner overlay
+
+`docker-compose.script-runner.yml` is an **optional overlay** (lmxopcua#780). It sets `Scripting:Runner=OutOfProcess` for the
+VirtualTag and Calculation seams on `central-1`/`central-2`, with a container-local `PeCacheDir`. The image must come from a branch
+that has the runner. Bring it up with
+`docker compose -f docker-dev/docker-compose.yml -f docker-dev/docker-compose.script-runner.yml up -d --no-deps central-1 central-2`.
+To go back to InProcess, run the same `up` with the base file alone.
+
+Note that `deploy.sh` reads its body from stdin whenever stdin is not a terminal. Run it as `./deploy.sh < /dev/null` from a
+script or a background job; otherwise curl waits on stdin forever.
+
 ## QuestDB historian overlay
 
 `docker-compose.questdb.yml` is an **optional overlay** (not part of the default rig) that adds one service, `questdb`