fix(runtime): restart-safe alarm host, mux last-value replay, VT log rate limit, Calculation remediation (E4)

- R02:H1 ScriptedAlarmHostActor gains a factory Props
  (Func<(upstream, engine)>) so every incarnation builds and owns its own
  engine; a supervision restart no longer re-creates the actor around a
  disposed engine. The legacy instance-taking Props stays source-compatible
  and is now restart-safe in the weaker sense (PreRestart marks the stop as
  a restart, PostStop then detaches instead of disposing). DriverHostActor
  still spawns through the legacy overload (not owned by this lane — F3).
- R02:H3 OnAlarmCommand runs every engine op under a 10 s token linked to
  the actor's lifetime (DefaultCommandTimeout / Props commandTimeout) and
  logs a Warning on timeout instead of suspending the mailbox on a stalled
  store.
- R02:L3 DependencyMuxTagUpstreamSource.RetainOnly(loaded dep-ref union),
  called after every successful load.
- R02:P6 VirtualTagActor's per-failure ScriptLogEntry is rate-limited per
  tag (ScriptLogRateLimiter, 20/min + one summary); the Bad publish and the
  metric are untouched.
- R07:H6 DependencyMuxActor retains the last (value, status, ts) per
  ever-registered ref (through unregisters) and replays them in one batch to
  a RegisterInterest(ReplayRetained: true) — VirtualTagActor, the Calculation
  mux adapter and the alarm host opt in; the historization recorder does not
  (a replay there would record a stale sample per deploy). CalculationDriver
  records inputs regardless of _running so a replay landing before
  InitializeAsync still satisfies the change-gate.
- R07:P4 CalculationEvaluator negative-caches compile failures by source
  hash (one Roslyn attempt + one Warning per source until redeploy); the
  driver's script-log entry fires on the Good→Bad transition or a change of
  reason, matching the once-per-transition Bad publish.
- R07:H8 array results dedup structurally.
- R07:L2 ShutdownAsync drops the compiled scripts (collectible ALCs).
- R07:U5 DraftValidator rule CalculationNoEffectiveTrigger: a tag with no
  timer whose change trigger is off or whose script has no literal
  ctx.GetTag read can never evaluate.

Refs #734

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Core/ZB.MOM.WW.OtOpcUa.Configuration.Tests/DraftValidatorCalculationTests.cs

@@ -82,7 +82,9 @@ public sealed class DraftValidatorCalculationTests
             DriverInstances = [CalcDriver()],
             Devices = [Device("dev-1", "di-calc", "engine")],
             Tags = [CalcTagRow("t-1", "dev-1", "a", Cfg("s1"))],
-            Scripts = [ScriptRow("s1", "return 42.0;")],
+            // A read, so the change trigger is effective (a constant change-triggered script with no timer
+            // is now itself a deploy error — CalculationNoEffectiveTrigger).
+            Scripts = [ScriptRow("s1", "return (double)ctx.GetTag(\"mb/plc/reg\").Value + 42.0;")],
         };
 
         DraftValidator.Validate(draft).ShouldNotContain(e => e.Code.StartsWith("Calculation"));
@@ -132,6 +134,58 @@ public sealed class DraftValidatorCalculationTests
         msg.ShouldContain("calc/engine/b");
     }
 
+    // ── effective-trigger gate (R07:U5) ─────────────────────────────────────────────────────
+
+    [Fact]
+    public void Change_triggered_tag_with_no_literal_read_and_no_timer_is_rejected()
+    {
+        var draft = new DraftSnapshot
+        {
+            GenerationId = 1, ClusterId = "c",
+            DriverInstances = [CalcDriver()],
+            Devices = [Device("dev-1", "di-calc", "engine")],
+            Tags = [CalcTagRow("t-1", "dev-1", "a", Cfg("s1"))],
+            Scripts = [ScriptRow("s1", "return ctx.Now.Hour;")],
+        };
+
+        DraftValidator.Validate(draft).ShouldContain(e =>
+            e.Code == "CalculationNoEffectiveTrigger" && e.Context == "t-1" && e.Message.Contains("no literal ctx.GetTag"));
+    }
+
+    [Fact]
+    public void Tag_with_change_trigger_off_and_no_timer_is_rejected()
+    {
+        var draft = new DraftSnapshot
+        {
+            GenerationId = 1, ClusterId = "c",
+            DriverInstances = [CalcDriver()],
+            Devices = [Device("dev-1", "di-calc", "engine")],
+            Tags = [CalcTagRow("t-1", "dev-1", "a", "{\"scriptId\":\"s1\",\"changeTriggered\":false}")],
+            Scripts = [ScriptRow("s1", "return (double)ctx.GetTag(\"mb/plc/reg\").Value;")],
+        };
+
+        DraftValidator.Validate(draft).ShouldContain(e => e.Code == "CalculationNoEffectiveTrigger" && e.Context == "t-1");
+    }
+
+    [Theory]
+    [InlineData("{\"scriptId\":\"s1\",\"changeTriggered\":true,\"timerIntervalMs\":1000}", "return ctx.Now.Hour;")]      // timer rescues a read-less script
+    [InlineData("{\"scriptId\":\"s1\",\"changeTriggered\":false,\"timerIntervalMs\":500}", "return 1.0;")]              // timer-only tag
+    [InlineData("{\"scriptId\":\"s1\",\"changeTriggered\":true}", "return (double)ctx.GetTag(\"mb/plc/reg\").Value;")] // change trigger with a read
+    [InlineData("{\"scriptId\":\"s1\"}", "return (double)ctx.GetTag(\"mb/plc/reg\").Value;")]                          // changeTriggered defaults to true
+    public void A_tag_with_an_effective_trigger_is_accepted(string cfg, string source)
+    {
+        var draft = new DraftSnapshot
+        {
+            GenerationId = 1, ClusterId = "c",
+            DriverInstances = [CalcDriver()],
+            Devices = [Device("dev-1", "di-calc", "engine")],
+            Tags = [CalcTagRow("t-1", "dev-1", "a", cfg)],
+            Scripts = [ScriptRow("s1", source)],
+        };
+
+        DraftValidator.Validate(draft).ShouldNotContain(e => e.Code == "CalculationNoEffectiveTrigger");
+    }
+
     [Fact]
     public void Cross_driver_ref_is_terminal_not_an_edge()
     {