fix(runtime): restart-safe alarm host, mux last-value replay, VT log rate limit, Calculation remediation (E4)

- R02:H1 ScriptedAlarmHostActor gains a factory Props
  (Func<(upstream, engine)>) so every incarnation builds and owns its own
  engine; a supervision restart no longer re-creates the actor around a
  disposed engine. The legacy instance-taking Props stays source-compatible
  and is now restart-safe in the weaker sense (PreRestart marks the stop as
  a restart, PostStop then detaches instead of disposing). DriverHostActor
  still spawns through the legacy overload (not owned by this lane — F3).
- R02:H3 OnAlarmCommand runs every engine op under a 10 s token linked to
  the actor's lifetime (DefaultCommandTimeout / Props commandTimeout) and
  logs a Warning on timeout instead of suspending the mailbox on a stalled
  store.
- R02:L3 DependencyMuxTagUpstreamSource.RetainOnly(loaded dep-ref union),
  called after every successful load.
- R02:P6 VirtualTagActor's per-failure ScriptLogEntry is rate-limited per
  tag (ScriptLogRateLimiter, 20/min + one summary); the Bad publish and the
  metric are untouched.
- R07:H6 DependencyMuxActor retains the last (value, status, ts) per
  ever-registered ref (through unregisters) and replays them in one batch to
  a RegisterInterest(ReplayRetained: true) — VirtualTagActor, the Calculation
  mux adapter and the alarm host opt in; the historization recorder does not
  (a replay there would record a stale sample per deploy). CalculationDriver
  records inputs regardless of _running so a replay landing before
  InitializeAsync still satisfies the change-gate.
- R07:P4 CalculationEvaluator negative-caches compile failures by source
  hash (one Roslyn attempt + one Warning per source until redeploy); the
  driver's script-log entry fires on the Good→Bad transition or a change of
  reason, matching the once-per-transition Bad publish.
- R07:H8 array results dedup structurally.
- R07:L2 ShutdownAsync drops the compiled scripts (collectible ALCs).
- R07:U5 DraftValidator rule CalculationNoEffectiveTrigger: a tag with no
  timer whose change trigger is off or whose script has no literal
  ctx.GetTag read can never evaluate.

Refs #734

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Validation/DraftValidator.cs

@@ -452,6 +452,54 @@ public static class DraftValidator
                 "Calculation tags form a dependency cycle (members: " + string.Join(", ", cycle) +
                 "); a calc→calc cycle is a live oscillation loop and must be broken before deploy",
                 cycle.Count > 0 ? cycle[0] : null));
+
+        // Rule 3 — effective-trigger gate (R07:U5). A calc tag evaluates on a declared dependency
+        // changing (change-trigger: the literal ctx.GetTag paths) and/or on a timer. A change-triggered
+        // tag whose script has NO literal reads (`return ctx.Now.Hour;`, a dynamic-path read) and no timer
+        // never evaluates at all: it sits BadWaitingForInitialData forever while the driver reports
+        // Healthy, and nothing warned. Same for a tag that is neither change- nor timer-triggered.
+        foreach (var (t, _, scriptId) in calcTags)
+        {
+            var (changeTriggered, timerIntervalMs) = ParseTriggers(t.TagConfig);
+            if (timerIntervalMs is > 0) continue;
+            var source = scriptId is not null && scriptSourceById.TryGetValue(scriptId, out var s) ? s : null;
+            var depCount = EquipmentScriptPaths.ExtractDependencyRefs(source).Count;
+            if (changeTriggered && depCount > 0) continue;
+            errors.Add(new("CalculationNoEffectiveTrigger",
+                changeTriggered
+                    ? $"Calculation tag '{t.TagId}' is change-triggered but its script has no literal ctx.GetTag read, " +
+                      "and it has no timerIntervalMs — nothing would ever evaluate it. Add a dependency read or a timer."
+                    : $"Calculation tag '{t.TagId}' has changeTriggered=false and no timerIntervalMs — nothing would ever evaluate it. " +
+                      "Enable the change trigger or add a timer.",
+                t.TagId));
+        }
+    }
+
+    /// <summary>Read the trigger fields from a calc tag's <c>TagConfig</c>: <c>changeTriggered</c>
+    /// (default <c>true</c>, the driver's own default) and <c>timerIntervalMs</c> (null when absent or not a
+    /// number). Never throws — malformed JSON yields the defaults.</summary>
+    private static (bool ChangeTriggered, int? TimerIntervalMs) ParseTriggers(string? tagConfig)
+    {
+        if (string.IsNullOrWhiteSpace(tagConfig)) return (true, null);
+        try
+        {
+            using var doc = System.Text.Json.JsonDocument.Parse(tagConfig);
+            var root = doc.RootElement;
+            if (root.ValueKind != System.Text.Json.JsonValueKind.Object) return (true, null);
+            var changeTriggered = true;
+            if (root.TryGetProperty("changeTriggered", out var ct)
+                && ct.ValueKind is System.Text.Json.JsonValueKind.False or System.Text.Json.JsonValueKind.True)
+                changeTriggered = ct.GetBoolean();
+            int? timer = null;
+            if (root.TryGetProperty("timerIntervalMs", out var tm)
+                && tm.ValueKind == System.Text.Json.JsonValueKind.Number && tm.TryGetInt32(out var ms))
+                timer = ms;
+            return (changeTriggered, timer);
+        }
+        catch (System.Text.Json.JsonException)
+        {
+            return (true, null);
+        }
     }
 
     /// <summary>Extract the <c>scriptId</c> string from a calc tag's schemaless <c>TagConfig</c> JSON. Never