docs(deploy): QA canary, #890 re-apply, live #794 worker check and #780 runaway drill on vq03/vq04

- #890: installer at f75ee7d0 re-applied on both nodes with -DenyPaths root, pki, data and
  C:\ProgramData\ZB\kek (the Secrets KEK sits outside the install root); second apply 12/12 unchanged.
- Script-runner canary authored in the AdminUI and deployed (Calculation tag + VirtualTag, 1 s timers):
  Good and advancing on both endpoints; kept on QA as a runner monitor.
- #794 step 5: the live worker token is restricted (SeChangeNotify only; identity/Everyone/Users/RESTRICTED)
  and is denied read and write on pki, data, app, logs and the KEKs; network sockets none. Finding #891.
- #780: QA runaway drill passed (killed at the 4000 ms hard deadline twice, quarantined, siblings Good,
  ServiceLevel 250/240 unchanged); drill removed, redeploy back to the canary revision 82dd0598.
- #780 P4 recorded: InProcess stays the default and the rollback; StuckOrphanQuarantineFactor documented
  as in-process only.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

docs/ScriptEditor.md

@@ -193,8 +193,10 @@ scripted-alarm predicates) runs scripts through the shared `ScriptRunGuard`:
   a run that returns (value or throw) resets it. A quarantined script is never
   dispatched again; it reads Bad `"script quarantined: …"`, logs one Error and
   increments `otopcua_script_quarantined`.
-- **Stuck-orphan quarantine.** A never-returning script (`while(true)`) times out
-  once and is then only refused, so the timeout streak alone never reaches 3.
+- **Stuck-orphan quarantine** (in-process runner only: `Scripting:Runner=InProcess`, the default and
+  the rollback; under `OutOfProcess` a never-returning script is killed at `T + G` and quarantined
+  after two kills, so this rule never fires there — lmxopcua#780 P4). A never-returning script
+  (`while(true)`) times out once and is then only refused, so the timeout streak alone never reaches 3.
   Instead, a refusal behind an orphan that has been running longer than
   `Scripting:StuckOrphanQuarantineFactor` × the timeout (default 10 × — 20 s at the
   2 s default) quarantines immediately, through the same path (Error log, metric
@@ -234,7 +236,7 @@ scripted-alarm predicates) runs scripts through the shared `ScriptRunGuard`:
   | `Scripting:RunTimeout` | `00:00:02` (2 s) | zero or negative becomes the default; above `00:01:00` becomes 60 s. The per-run budget of virtual tags and scripted-alarm predicates (lmxopcua#779 — alarms used to fall back to 250 ms). Calculation tags keep their per-driver `runTimeoutMs`. |
   | `Scripting:MaxAllocBytesPerRun` | `67108864` (64 MB) | `0` (or negative) disables the budget; a positive value below `1048576` (1 MB) becomes 1 MB |
   | `Scripting:QuarantineAfterConsecutiveTimeouts` | `3` | `1`–`1000` |
-  | `Scripting:StuckOrphanQuarantineFactor` | `10` | `0` (or negative) disables the rule; above `1000` becomes `1000`; `NaN` becomes the default |
+  | `Scripting:StuckOrphanQuarantineFactor` | `10` | `0` (or negative) disables the rule; above `1000` becomes `1000`; `NaN` becomes the default. In-process runner only (lmxopcua#780 P4) |
 
   A Calculation driver may override `maxAllocBytesPerRun` and
   `quarantineAfterConsecutiveTimeouts` in its own driver config. Those keys are