feat(scripting): deny System.Threading, Type reflection entry points and RuntimeHelpers in the sandbox (E2)

R05:10 — the namespace deny-list covered System.Threading.Tasks but not
System.Threading, so SemaphoreSlim / Monitor / SpinWait / Mutex /
EventWaitHandle could park a script's pool thread past its budget (or touch a
system-global kernel object); System.Type.GetType(string) / GetMethod* /
InvokeMember and System.Runtime.CompilerServices.RuntimeHelpers resolved and
reach a forbidden type without naming it syntactically.

ForbiddenTypeAnalyzer now denies the whole System.Threading namespace with a
type-granular allow-list (CancellationToken, Interlocked, Volatile — the
sync-free primitives), adds a member deny-list for System.Type's reflection
entry points (GetType/GetMethod(s)/InvokeMember/GetProperty(ies)/GetField(s)/
GetMember(s)/GetConstructor(s)/GetEvent(s)/GetDefaultMembers; instance
object.GetType() stays allowed) and puts RuntimeHelpers on the type deny-list.
Thread/ThreadPool/Timer leave the type list — the prefix rule reaches them.

R05:11 — the allocation budget landed with E1's ScriptRunGuard
(Scripting:MaxAllocBytesPerRun, default 64 MB): sampled around each run,
breach quarantines. It is observation after the fact; a pre-emptive OOM guard
still needs an out-of-process runner (follow-up issue in the lane report).

The Monaco editor shares the analyzer, so DiagnoseTests pins every new form
as an OTSCRIPT_FORBIDDEN marker and every allow-listed form as clean.

Refs #734

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/ScriptAnalysis/DiagnoseTests.cs

@@ -31,6 +31,26 @@ public sealed class DiagnoseTests
         => Diag("""var c = new System.Net.Http.HttpClient(); return 0;""")
             .ShouldContain(x => x.Severity == 8);
 
+    // Sandbox hardening parity (R05:10): the editor runs the SAME ForbiddenTypeAnalyzer the publish gate
+    // runs, so every newly-denied form must surface as an OTSCRIPT_FORBIDDEN marker here — editor accepts
+    // ⇔ publish accepts. One case per deny mechanism (namespace, member, type), plus the allow-list.
+    [Theory]
+    [InlineData("""new System.Threading.SemaphoreSlim(0).Wait(); return 0;""")]                                   // System.Threading namespace
+    [InlineData("""System.Threading.SpinWait.SpinUntil(() => false); return 0;""")]
+    [InlineData("""var t = System.Type.GetType("System.IO.File"); return t is null ? 0 : 1;""")]                   // forbidden member
+    [InlineData("""return typeof(string).GetMethods().Length;""")]
+    [InlineData("""var o = System.Runtime.CompilerServices.RuntimeHelpers.GetUninitializedObject(typeof(string)); return 0;""")] // forbidden type
+    public void Hardened_sandbox_forms_are_flagged_in_the_editor(string code)
+        => Diag(code).ShouldContain(x => x.Code == "OTSCRIPT_FORBIDDEN" && x.Severity == 8);
+
+    [Theory]
+    [InlineData("""var t = System.Threading.CancellationToken.None; return t.IsCancellationRequested ? 1 : 0;""")]
+    [InlineData("""var x = 41; System.Threading.Interlocked.Increment(ref x); return x;""")]
+    [InlineData("""var x = 42; return System.Threading.Volatile.Read(ref x);""")]
+    [InlineData("""object o = 42; return o.GetType().IsValueType ? 1 : 0;""")]
+    public void Allow_listed_forms_are_not_flagged_in_the_editor(string code)
+        => Diag(code).ShouldBeEmpty();
+
     [Fact] public void Dynamic_tag_path_is_flagged()
         => Diag("""var p = "A"; return ctx.GetTag(p).Value;""")
             .ShouldContain(x => x.Message.Contains("literal"));