docs(mesh-phase4): Task 2 done; fold review findings into Task 4 brief

Task 2 code review surfaced two unguarded ConfigDb sites reachable on a
driver-only node once Tasks 0+1 landed (SpawnScriptedAlarmHost's Ef store,
unconditional UpsertNodeDeploymentState). Task 4 brief now names them + the
dbFactory! removal; Task 6 re-homes the alarm store to LocalDb.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/plans/2026-07-23-mesh-phase4-cut-driver-configdb.md.tasks.json

@@ -28,10 +28,12 @@
     {
       "id": 2,
       "subject": "Task 2: DbHealthProbeActor \u2014 no spawn on driver-only; DbReachable=true constant",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": [
         1
-      ]
+      ],
+      "commit": "9565827",
+      "result": "43 tests; spec-compliant + code-review (comment fixed to honest interim; functional fix = Task 4/6)"
     },
     {
       "id": 3,