test(mesh): real two-ActorSystem ClusterClient boundary test with falsifiability control

Two genuinely separate single-member clusters sharing the ActorSystem name and
joined only by ClusterClient, so the mesh boundary is exercised over the wire
rather than through an in-process relay: a relay cannot fail for a missing
receptionist extension, an unregistered service, a malformed contact path or a
serialization break, which are the Phase 2 failure modes.

Covers both legs plus the control:
  * central SendToAll -> node comm actor -> node EventStream
  * node ApplyAck -> central comm actor, through the node's own client
  * a node without the receptionist extension receives nothing

Sabotage-verified. Suppressing the node-side EventStream publish and the
outbound ack Tell reddens one leg each. Restoring the receptionist and the
service registration on the control node reddens the control, which is what
proves the control's send is live rather than silently misaddressed.

The control removes the extension AND the RegisterService call, since resolving
the receptionist to register would materialise the extension whose absence is
the point; it falsifies "delivery happens without a receptionist boundary", not
the extension line alone. Recorded in the test.

Also corrects MeshCommActorPathTests: with one node per side, per-node and
singleton registration are indistinguishable here, so the property the dropped
Task 6 assertion covered belongs to live-gate step 8, not to this class.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/MeshCommActorPathTests.cs

@@ -57,6 +57,10 @@ public class MeshCommActorPathTests
     //
     // A sabotage that re-registered CentralCommunicationActor via WithSingleton left both green,
     // which is what exposed them. Rather than ship an assertion I could not make fail, the property
-    // is left to MeshClusterClientBoundaryTests: a ClusterClient send only arrives if the target is
-    // actually registered with the receptionist, which is the thing that matters.
+    // is left to live-gate step 8 (stop the OLDEST central; the survivor's comm actor must still
+    // receive a node ack, which a singleton hosted on the stopped node cannot).
+    //
+    // NOT MeshClusterClientBoundaryTests: that class proves a send only arrives if the target is
+    // registered with the receptionist, which is necessary but not discriminating — with one node
+    // per side, per-node and singleton registration look identical.
 }