test(galaxy): #865 review round 7 - pin the superseded-pump fault filter

Adds an escalated-stream-fault test seam and a test: the live pump's fault
escalates (positive controls before and after), a superseded pump's late
fault after a reopen does not; the absence is asserted only once both
pumps' callbacks are known to have run (HasEnded). Verified to fail with
the filter disabled. The filter's comment now says the identity check does
the work and warns about a future session bump while Healthy.

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/GalaxyDriver.cs

@@ -2445,6 +2445,11 @@ public sealed class GalaxyDriver
     ///     replay; without this hand-off a transient transport drop permanently kills
     ///     the event stream and <c>GetHealth()</c> keeps reporting Healthy.
     /// </summary>
+    private int _escalatedStreamFaults;
+
+    /// <summary>Test seam (#865): stream faults that passed the superseded-pump filter (escalated toward the supervisor).</summary>
+    internal int EscalatedStreamFaultsForTests => Volatile.Read(ref _escalatedStreamFaults);
+
     private void OnEventPumpStreamFault(EventPump? source, Exception cause)
     {
         if (_runtimeStopping)
@@ -2461,13 +2466,16 @@ public sealed class GalaxyDriver
             lock (_pumpLock) stale = !ReferenceEquals(_eventPump, source) || source.Session != _subscriptions.CurrentSession;
             if (stale)
             {
-                // A pump that is no longer the live one (its session was reopened; the replay replaces or
-                // already replaced it). Its fault says nothing about the current transport — and reported
-                // while Replaying it would fail a good replay (#865 review).
+                // A pump that is no longer the live one: the identity check does the work (the replay
+                // replaces/replaced it). The session part only matters between a reopen and its replay,
+                // where the supervisor ignores faults anyway — ⚠️ a future session bump while Healthy that
+                // keeps the same pump would make its real faults look stale here. Its fault says nothing
+                // about the current transport, and reported while Replaying it would fail a good replay.
                 _logger.LogDebug(cause, "GalaxyDriver {InstanceId} ignored a stream fault from a superseded event pump.", _driverInstanceId);
                 return;
             }
         }
+        Interlocked.Increment(ref _escalatedStreamFaults);
 
         var supervisor = _supervisor;
         if (supervisor is null)