docs(deploy): QA canary, #890 re-apply, live #794 worker check and #780 runaway drill on vq03/vq04

- #890: installer at f75ee7d0 re-applied on both nodes with -DenyPaths root, pki, data and
  C:\ProgramData\ZB\kek (the Secrets KEK sits outside the install root); second apply 12/12 unchanged.
- Script-runner canary authored in the AdminUI and deployed (Calculation tag + VirtualTag, 1 s timers):
  Good and advancing on both endpoints; kept on QA as a runner monitor.
- #794 step 5: the live worker token is restricted (SeChangeNotify only; identity/Everyone/Users/RESTRICTED)
  and is denied read and write on pki, data, app, logs and the KEKs; network sockets none. Finding #891.
- #780: QA runaway drill passed (killed at the 4000 ms hard deadline twice, quarantined, siblings Good,
  ServiceLevel 250/240 unchanged); drill removed, redeploy back to the canary revision 82dd0598.
- #780 P4 recorded: InProcess stays the default and the rollback; StuckOrphanQuarantineFactor documented
  as in-process only.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

docs/plans/2026-11-09-out-of-process-script-runner-design.md

@@ -719,6 +719,11 @@ per-shard state, restarts in the last hour and the quarantine list. Quarantines
      hold), so tier rollout rides normal deploys.
 5. **P4, decide the long-term status of `InProcess`.** The recommendation is to keep it for dev and tests and
    as the documented rollback, and to retire `StuckOrphanQuarantineFactor` from the docs as "in-process only".
+   - **Decided (owner, §14, 2026-11-09) and recorded 2026-11-12:** `InProcess` stays the compiled default (dev, tests,
+     docker-dev) and the documented rollback (set the flag back and restart the node). `StuckOrphanQuarantineFactor`
+     is documented as in-process only in `docs/ScriptEditor.md`. The QA flip with the live runaway drill passed
+     (record: `docs/deploy/qa-upgrade-b8b4c18f-to-fea7de0a.md`, section "Canary, live isolation check and runaway
+     drill").
 
 **Rollback:** set the flag back to `InProcess` and restart the node. No data or config migration is involved.
 The PE cache directory can be deleted at any time.
@@ -1663,7 +1668,7 @@ measures the §8 table: p50/p99 added latency, throughput at K=1/2/4, host CPU,
 - docker-dev rig: a deploy with VTs, Calc tags and scripted alarms; drill a runaway script through the
   AdminUI and watch `/uns` go Bad, the quarantine appear, and siblings stay Good;
 - ~~QA shadow week (P2)~~ — dropped by the owner 2026-11-12;
-- a QA flip with the same drill.
+- a QA flip with the same drill. **Done 2026-11-12** on vq03/vq04 (record above).
 
 ---