fix(mesh-phase4): OpcUaPublish diff-applies from in-hand bytes with no ConfigDb (no wipe)

A driver-only node has a null dbFactory but a wired applier; the old combined
guard routed it to the raw-sink fallback that wipes the address space and never
re-materialises. Split the guard so in-hand artifact bytes drive the real
diff-and-apply; a missing artifact abandons the rebuild (keep last-known-good,
#485) instead of wiping.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/OpcUa/OpcUaPublishActor.cs

@@ -359,10 +359,15 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
         using var span = OtOpcUaTelemetry.StartAddressSpaceRebuildSpan();
         span?.SetTag("otopcua.correlation_id", msg.Correlation.ToString());
 
-        // Two modes: when dbFactory + applier are wired, do a real diff-and-apply pass against
-        // the latest deployment artifact. Without them, fall back to a raw sink rebuild — the
-        // F10b/dev path before the integration completes.
-        if (_dbFactory is null || _applier is null)
+        // Two modes. With an applier wired, do a REAL diff-and-apply pass — driven either by the
+        // artifact bytes already in hand (a per-cluster-mesh driver-only / FetchAndCache node, whose
+        // ConfigDb is admin-only now so _dbFactory is null, hands its fetched/cached bytes in
+        // msg.Artifact) or, when no bytes are carried, by loading the artifact from the ConfigDb (the
+        // Direct path, which requires _dbFactory). Only a node with NO applier at all (the F10b/dev
+        // seam) falls back to the raw-sink rebuild — and that fallback WIPES the served address space
+        // without re-materialising, so it must NEVER be reached by a real driver node that has an
+        // applier but simply has no ConfigDb (that node diff-and-applies from its in-hand bytes below).
+        if (_applier is null)
         {
             try
             {
@@ -379,15 +384,20 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
 
         try
         {
-            // An in-hand artifact (boot-from-cache) wins: the host already has the cached bytes, and
-            // the ConfigDb read the DeploymentId path would do is exactly what is unreachable during
-            // the outage this exists to survive. Otherwise prefer the artifact of the deployment the
-            // host just applied — at apply time it is not yet Sealed, so LoadLatestArtifact would
-            // return the PREVIOUS revision and materialise a stale composition (variables that don't
-            // match the SubscribeBulk refs). Fall back to latest-sealed only for legacy callers that
-            // carry neither.
+            // An in-hand artifact (boot-from-cache / FetchAndCache) wins: the host already has the
+            // cached/fetched bytes, and the ConfigDb read the DeploymentId path would do is exactly what
+            // is unreachable during the outage this exists to survive — and is simply absent on a
+            // driver-only node with no ConfigDb. Otherwise, when a ConfigDb is present (Direct mode),
+            // prefer the artifact of the deployment the host just applied — at apply time it is not yet
+            // Sealed, so LoadLatestArtifact would return the PREVIOUS revision and materialise a stale
+            // composition (variables that don't match the SubscribeBulk refs); fall back to latest-sealed
+            // only for legacy callers that carry neither. With NO bytes AND no ConfigDb there is nothing
+            // to load, so yield Array.Empty<byte>() — the #485 guard below reads that as "no answer" and
+            // abandons the rebuild, holding last-known-good rather than wiping the address space.
             var artifact = msg.Artifact
-                ?? (msg.DeploymentId is { } depId ? LoadArtifact(depId) : LoadLatestArtifact());
+                ?? (_dbFactory is not null
+                    ? (msg.DeploymentId is { } depId ? LoadArtifact(depId) : LoadLatestArtifact())
+                    : Array.Empty<byte>());
 
             // Issue #485 — an artifact we could not obtain is NOT an empty configuration. Parsing zero
             // bytes yields an empty composition, which the planner diffs against the live one as a