fix(acl): authorize scripted alarm commands at their owning equipment's scope (#797)

Scripted condition NodeIds are opaque ScriptedAlarmIds, so splitting them as a
topology path could never match an Equipment grant: a narrow equipment grant was
denied while a Cluster grant passed.

- OtOpcUaNodeManager binds each LIVE scripted condition instance to the
  EquipmentId it was materialised under (only when it hangs under that folder);
  dropped on remove / drop-recreate / equipment-subtree removal / rebuild; a
  same-id re-materialise under another equipment re-parents and re-binds.
- DataPlaneAuthoritySnapshot carries EquipmentScopePaths (EquipmentId ->
  [uns, Area, Line, Equipment]) decoded from the artifact by the same
  AclScopePathResolver call that plants Equipment grants.
- DataPlaneAuthorizer.AuthorizeScriptedCondition re-reads key, grant and
  generation per call (uncached) and evaluates at the owner path; unbound,
  replaced or unplaceable owners deny under every grant. No id-split or
  realm-root fallback.
- Native conditions (RawPath) and the ACL-off role gate are unchanged.
  NodeIds and AlarmCommand.AlarmId are unchanged.

Sdk2OpaqueScriptedScopeBaselineTests deliberately flipped: it pinned the denial
and now pins owner-grant allow / sibling deny / cluster allow. Follow-up #808
(folder ids + Server-object event visibility for narrow UNS grants).

scripts/validation/opcua-scripted-alarm-baseline/README.md

@@ -25,8 +25,10 @@ unchanged. Never load this assembly or old SDK into the candidate process.
 The real session has no application-wide roles. The production-valid opaque
 scripted ID is denied by an Equipment grant, routes nothing, and is then allowed
 by an explicit Cluster grant. A passing probe pins **both** outcomes; it does not
-claim narrow equipment authorization works. The independent candidate counterpart
-is `Sdk2OpaqueScriptedScopeBaselineTests`.
+claim narrow equipment authorization works. The candidate counterpart
+`Sdk2OpaqueScriptedScopeBaselineTests` pinned the same denial until #797 was fixed; it now pins the fixed
+behaviour (owning equipment grant allows, sibling equipment grant denies, cluster grant still allows). This
+probe remains the record of the pre-fix behaviour on the original commit.
 
 Do not make the ID slash-qualified to get a positive result: the current UI
 rejects `/`, and that would hide the production scope-resolution defect. A future