fix(driver-galaxy): resolve Low code-review findings (Driver.Galaxy-005,010,012,013)

- Driver.Galaxy-005: rewrite the EventPump BoundedChannelOptions comment
  to honestly describe the Wait+TryWrite pattern.
- Driver.Galaxy-010: ResolveApiKey now warns when a literal API key is
  used in production wiring; added an explicit dev: prefix for known
  cleartext-in-dev cases and rewrote the GalaxyGatewayOptions doc.
- Driver.Galaxy-012: O(1) reverse-lookup for SubscriptionRegistry
  dispatch via per-entry FullRefByItemHandle map; immutable hash-set for
  the cross-binding reverse map; SubscribeAsync / ReadViaSubscribeOnce
  use BuildResultIndex for per-reference correlation.
- Driver.Galaxy-013: ReinitializeAsync now validates the incoming JSON
  against the running options; ReplayOnSessionLost honoured by the
  Replay path; class summary rewritten to describe the shipped surface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Tests/GalaxyDriverApiKeyResolverTests.cs

@@ -1,3 +1,4 @@
+using Microsoft.Extensions.Logging;
 using Shouldly;
 using Xunit;
 
@@ -69,6 +70,61 @@ public sealed class GalaxyDriverApiKeyResolverTests
         ex.Message.ShouldContain("doesn't exist");
     }
 
+    // ===== Driver.Galaxy-010 regression: literal arm warns + dev: prefix path =====
+
+    [Fact]
+    public void Literal_string_emits_warning_when_logger_supplied()
+    {
+        // A literal API key on a production deployment means the cleartext key sits
+        // in the DriverConfig JSON. The resolver must surface a warning so an
+        // operator who committed one by accident sees it at startup.
+        var logger = new CaptureLogger();
+        var key = GalaxyDriver.ResolveApiKey("plain-text-key", logger);
+
+        key.ShouldBe("plain-text-key");
+        logger.Entries.ShouldContain(e =>
+            e.Level == LogLevel.Warning && e.Message.Contains("literal", StringComparison.OrdinalIgnoreCase));
+    }
+
+    [Fact]
+    public void Dev_prefix_returns_literal_without_warning()
+    {
+        // An explicit dev: prefix signals the operator knowingly opted into a literal
+        // key (dev / parity rig). The resolver must accept it AND suppress the
+        // warning so production logs aren't polluted on a deliberate dev choice.
+        var logger = new CaptureLogger();
+        var key = GalaxyDriver.ResolveApiKey("dev:plain-text-key", logger);
+
+        key.ShouldBe("plain-text-key");
+        logger.Entries.ShouldNotContain(e => e.Level == LogLevel.Warning);
+    }
+
+    [Fact]
+    public void Env_prefix_does_not_emit_literal_warning()
+    {
+        const string name = "OTOPCUA_TEST_GALAXY_API_KEY_NOWARN";
+        Environment.SetEnvironmentVariable(name, "v");
+        try
+        {
+            var logger = new CaptureLogger();
+            GalaxyDriver.ResolveApiKey($"env:{name}", logger);
+            logger.Entries.ShouldNotContain(e => e.Level == LogLevel.Warning);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(name, null);
+        }
+    }
+
+    private sealed class CaptureLogger : ILogger
+    {
+        public List<(LogLevel Level, string Message)> Entries { get; } = new();
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+        public bool IsEnabled(LogLevel logLevel) => true;
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+            => Entries.Add((logLevel, formatter(state, exception)));
+    }
+
     [Fact]
     public void File_prefix_empty_file_throws()
     {