fix(runtime): route a reprovision by incarnation, not driver id (review F2)

A ReprovisionRequested in flight from an old incarnation could reach the NEW child
after HandleRestartDriver swapped it in. In Connecting that child DOES handle
InitializeRequested, so it started a second concurrent InitializeAsync, racing the
#527 dispose-before-overwrite.

Seen RED: InitializeCount == 2 on a child held in Connecting by a gated init
(an already-connected child swallows InitializeRequested and passes vacuously).

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -3017,6 +3017,20 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         // Already stopped (a restart racing a reconcile that removed the driver) — nothing to provision.
         if (!_children.TryGetValue(msg.DriverInstanceId, out var entry)) return;
 
+        // Route by INCARNATION, not just by id. This message is delivered asynchronously, so one can still
+        // be in flight from an OLD incarnation after HandleRestartDriver stopped that child and spawned a
+        // replacement under the same DriverInstanceId. Delivered to the new child — which is in Connecting,
+        // where InitializeRequested IS handled — it would start a second, concurrent InitializeAsync,
+        // racing the dispose-before-overwrite that #527's teardown exists to serialise
+        // (ModbusDriver._transport, MqttDriver._connection each leak a transport on that race).
+        if (!Equals(Sender, entry.Actor))
+        {
+            _log.Debug(
+                "DriverHost {Node}: dropping a reprovision for {Id} from a superseded incarnation ({Stale})",
+                _localNode, msg.DriverInstanceId, Sender);
+            return;
+        }
+
         // A crash that Akka silently restarted is otherwise invisible to operators; name it.
         _log.Warning(
             "DriverHost {Node}: driver child {Id} was restarted by supervision after {Reason} — re-provisioning",