fix(runtime): #869 review round 2 — a carry-through transition no longer settles a pending local ack

NativeAlarmProjector dropped the pending local ack on EVERY driver transition,
so an operator ack followed by the alarm returning to normal (a Clear carrying
the optimistic ack) inside the confirmation window made a later "not
confirmed" report a no-op — the condition stayed inactive+acked while Galaxy
showed UNACK_RTN. Only a transition that states the ack (Acknowledge,
ActiveAcknowledged, or an un-acking Raise/Retrigger/InactiveUnacknowledged)
now settles it; a Clear / same-message Raise / Unspecified update leaves it
revertible, and the revert projects inactive+unacked.

Tests: projector + host end-to-end (ack, Clear, confirmation fails -> inactive
+ unacked); tightened the confirmed-ack positive controls; pinned that the
confirmation receives the same request instance as AcknowledgeAsync.

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

docs/AlarmTracking.md

@@ -474,7 +474,10 @@ from the scripted `AlarmCommandRouter`:
    condition event). An ack whose owning driver is not running (disabled,
    not yet spawned) or is a stub on this node is reverted the same way by
    the host itself (#765). Only an ack still pending in `NativeAlarmProjector` is
-   reverted: a driver transition projected since then is authoritative. A
+   reverted: a driver transition projected since then that states the ack
+   (Acknowledge, ActiveAcknowledged, or an un-acking Raise/Retrigger/
+   InactiveUnacknowledged) is authoritative; one that only carries the ack
+   through (a Clear, a same-message Raise) leaves it revertible (#869). A
    refusal the driver can decide without I/O (Galaxy, with no fallback ack
    account: an anonymous session, or a keyed session whose key the cached
    `GalaxyAckIdentityDirectory` knows has no ack identity — #765) is instead