fix(scripting): only timeouts are quarantine strikes; alarm Bad annotation once per bucket change (fix round 1 I1, I3)

- I1 ScriptRunGuard: a run refused because the previous one is still
  executing is a Bad publish plus otopcua.script.run_refused, and no longer
  a quarantine strike. Only a timeout (and an allocation breach) counts;
  a refusal neither adds to nor resets the timeout streak; a completed run
  (value or throw) resets it. On a 1 Hz trigger with a 2 s budget a single
  4 s overrun is one timeout plus two refusals and must not quarantine.
  Tests updated across the guard, the alarm engine, the Calculation
  evaluator and the VT evaluator, plus
  Refusals_neither_count_toward_nor_reset_the_timeout_streak.
- I3 ScriptedAlarmEngine: the quality bucket is tracked only after the
  predicate completes (or in the inputs-not-ready path), so the tracked
  bucket is the last one annotated. A refused or quarantined predicate
  used to re-track the input bucket Good before the attempt and then flip
  it Bad, emitting QualityChanged on every push. The run-guard tests now
  count emissions (exactly 1 across N pushes, refused and quarantined
  cases), with a healthy sibling's dispatch count as the positive control
  that every push was processed. Both were red before the fix.

Refs #734

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ScriptingOptions.cs

@@ -33,10 +33,11 @@ public sealed class ScriptingOptions
     public long MaxAllocBytesPerRun { get; set; } = DefaultMaxAllocBytesPerRun;
 
     /// <summary>
-    ///     Consecutive non-completions (a run that times out, or a run refused because the previous one is
-    ///     still executing) after which the script is quarantined: no further runs are dispatched, every
+    ///     Consecutive timeouts after which the script is quarantined: no further runs are dispatched, every
     ///     evaluation reports Bad, and the quarantine lifts only on a source change, a redeploy or an explicit
-    ///     reset. Default 3; values below 1 are treated as 1.
+    ///     reset. Only a timeout is a strike — a run refused because the previous one is still executing is
+    ///     reported Bad and counted, but neither adds to nor resets the streak; a completed run (value or
+    ///     throw) resets it. Default 3; values below 1 are treated as 1.
     /// </summary>
     public int QuarantineAfterConsecutiveTimeouts { get; set; } = DefaultQuarantineAfterConsecutiveTimeouts;
 }