fix(historian): the recorder died on its first value — live gate for continuous historization (#491)

Ran #491's live gate against a real ZB.MOM.WW.HistorianGateway talking to a real AVEVA
Historian, and it found a production-fatal defect on the first value it ever saw.

ContinuousHistorizationRecorder.OnValueChangedAsync touched `Self` after awaiting
IHistorizationOutbox.AppendAsync(...).ConfigureAwait(false). ConfigureAwait(false) discards
Akka's ActorTaskScheduler synchronization context, so `Self` — which reads ActorBase.Context —
threw NotSupportedException. The throw escaped into supervision, which RESTARTED the actor;
because production seeds an EMPTY ref set (the deployed set arrives later via
UpdateHistorizedRefs), the restart silently discarded every historized ref. Net effect: one
value captured, then nothing, with no further error to show for it. Fixed by capturing
`IActorRef self = Self` before the await — the idiom the GetStatus handler already applied to
Sender.

Thirteen unit tests missed it because InMemoryOutbox.AppendAsync returned
ValueTask.CompletedTask: a completed ValueTask never yields, so the continuation ran inline
with the context still installed. The production FasterLog outbox fsyncs per entry and does
yield. The first regression test was itself vacuous — `await Task.Yield()` posts back to the
CAPTURED context, so the append still completed on the actor thread and reverting the fix left
the test green. The fake must complete on a POOL thread (Task.Delay(1).ConfigureAwait(false)),
as a real fsync does; with that, reverting the fix reddens exactly one test.

The rig could not run this gate at all: docker-dev carried ServerHistorian__* but no
ContinuousHistorization__* keys, so the recorder could never spawn. Both centrals now carry
them (default OFF — the recorder needs ContinuousHistorization:Enabled AND
ServerHistorian:Enabled), with the outbox on the per-node named volume so it survives a
container recreate. ServerHistorian__UseTls was hard-coded true and is now parameterized; a
plaintext h2c gateway was unreachable without it.

Gate results: outbox append, drain, WriteLiveValues accepted by a real historian, and restart
convergence (capture resumes after a restart with no new deployment) all pass. The read-back
hop is NOT proven — the LAN historian accepts writes but serves no reads under a "License
violation: Database tag count exceeds license tag count", and the licensed corporate one needs
the VPN. EnsureTags provisioning is likewise unexercised there (RemoteGrpc-only, and that CAP
is not listening). #491 stays open for the read-back hop alone.

Also recorded, not fixed: the recorder has NO Primary gate, unlike the alarm store-and-forward
sink, so both nodes of a redundant pair send duplicate live values. Gating it would introduce a
failover window with no capture — that is a design decision, not a cleanup.

Evidence: docs/plans/2026-08-01-continuous-historization-live-gate.md

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

docs/Historian.md

@@ -114,15 +114,27 @@ source it from there.
 > hardcodes OPC-DA Good, `192`). Capturing real per-node quality will not persist until the gateway honors
 > the field — see `GatewayHistorianValueWriter`'s remarks (archreview 06/C-7).
 
-> ⚠️ **Continuous value capture is code-complete but UNPROVEN IN PRODUCTION
-> ([#491](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/491)).** The recorder, the FasterLog
-> outbox, the gateway value-writer and the deploy-time historized-ref feed
-> (`AddressSpaceApplier.FeedHistorizedRefs` → `ActorHistorizedTagSubscriptionSink` →
-> `ContinuousHistorizationRecorder.UpdateHistorizedRefs`) are all wired, and the recorder converges to
-> the deployed ref set from the first deploy onward. What has **not** run is the end-to-end live gate
-> (deploy → dependency-mux value delta → outbox append → `WriteLiveValues`) plus a restart-convergence
-> test. **Reads and alarm-writes are live-validated; treat value capture as unproven rather than
-> absent.** See the "KNOWN LIMITATION 2" section of `CLAUDE.md`.
+> ✅ **Continuous value capture is LIVE-PROVEN as far as the historian's door
+> ([#491](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/491), gate run 2026-08-01 — see
+> `docs/plans/2026-08-01-continuous-historization-live-gate.md`).** Against a real
+> `ZB.MOM.WW.HistorianGateway` talking to a real AVEVA Historian: deploy → dependency-mux value delta →
+> FasterLog outbox append → drain → `WriteLiveValues` **accepted**, and **restart convergence** (the
+> recorder re-registers the deployed ref set after a process restart, with no new deployment) both pass.
+>
+> ⚠️ The gate found a **production-fatal defect**: the recorder threw `NotSupportedException` on the
+> **first value it ever appended**, because it touched `Self` after an `await …ConfigureAwait(false)`,
+> which discards Akka's ActorContext. Supervision restarted the actor, and since the recorder is seeded
+> with an *empty* ref set, the restart discarded every historized ref — historization stopped after one
+> value. Fixed; pinned by a regression test whose outbox fake completes on a **pool** thread (a fake
+> returning `ValueTask.CompletedTask`, or even `await Task.Yield()`, cannot reproduce it).
+>
+> ❌ **Still unproven: the read-back hop** — no available historian can serve it today (the LAN instance
+> accepts writes but serves no reads under a licence tag-count violation; the licensed corporate one needs
+> the VPN). `EnsureTags` provisioning is likewise unexercised there (`RemoteGrpc`-only). **#491 stays open
+> for that hop alone.**
+>
+> ⚠️ **Both nodes of a redundant pair historize the same value** — the recorder has no Primary gate,
+> unlike the alarm store-and-forward sink, so the historian receives duplicate live values per tag.
 >
 > **Related, separately open:** `EnsureTags` provisioning fires only for **newly-added** historized
 > tags (`AddressSpaceApplier` iterates the added set), so flipping an **existing** tag to