fix(galaxy): confirm unconfirmed native alarm acks against Galaxy's acknowledged transition (#869)

mxaccessgw answers AcknowledgeAlarm OK both when the AckMsg write was
applied and when it was only sent (no OnWriteComplete; the reply then
carries a diagnostic). EvaluateReply treated both as success, so the H6
live gate saw a condition go Acknowledged while Galaxy never applied it.

- EvaluateReply returns Applied (no diagnostic) or Unconfirmed (diagnostic)
  and logs the gateway diagnostic on every branch that carries one.
- GalaxyAckConfirmationTracker watches the alarm feed from before the RPC
  and, for an unconfirmed reply, waits up to AlarmAck.ConfirmTimeoutMs
  (default 10 s, 0 = old behaviour) for an Acknowledge/ActiveAcknowledged
  transition; on timeout it refuses (BadTimeout + diagnostic).
- New optional IAlarmAcknowledgeConfirmation: DriverInstanceActor awaits it
  after AcknowledgeAsync, off its mailbox and outside the resilience
  pipeline; a failure is the existing #760 AlarmAckFailed revert.
- AdminUI Galaxy form carries the new knob; docs updated.

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

docs/AlarmTracking.md

@@ -483,9 +483,16 @@ from the scripted `AlarmCommandRouter`:
    before anything is applied — as is every native ack while the driver host
    is Stale (configuration database unreachable at boot), when no ack can be
    routed or reverted (#765). Galaxy value writes have a separate correlated
-   write-outcome path. An awaited
-   ack RPC does not prove the ack reached AVEVA event history: the H6 live
-   verification remains [operator-gated](plans/2026-06-15-stillpending-phase-3-opcua-standards-design.md).
+   write-outcome path. **An OK ack reply is not proof (#869):** the gateway
+   also answers OK when the `AckMsg` write was only *sent* (its diagnostic
+   says so). The driver then waits — off the actor mailbox, outside the
+   resilience pipeline, bounded by `AlarmAck.ConfirmTimeoutMs` (default 10 s)
+   — for Galaxy's own acknowledged transition on the alarm feed
+   (`IAlarmAcknowledgeConfirmation`); without one the ack is reverted exactly
+   as above and the `BadTimeout` verdict plus the gateway diagnostic are
+   logged. See [`drivers/Galaxy.md` §Ack confirmation](drivers/Galaxy.md#ack-confirmation-869).
+   The H6 live verification of a confirmed ack reaching AVEVA event history
+   remains [operator-gated](plans/2026-06-15-stillpending-phase-3-opcua-standards-design.md).
 
 Only the **Acknowledge** is routed to the driver. **A native condition
 supports Acknowledge and AddComment only** (Gitea #587 review): `Confirm`,