fix(runtime): materialise from applied artifact + restore served state on bootstrap

Two ordering/lifecycle gaps surfaced once tag values began streaming:

1. OpcUaPublishActor.HandleRebuild loaded the latest *Sealed* artifact, but the
   rebuild fires at apply time — before this deployment seals — so it materialised
   the PREVIOUS revision while SubscribeBulk subscribed to the applied one. The two
   disagreed (4 variables materialised vs 396 subscribed) and every config needed
   two deploys. RebuildAddressSpace now carries the applied DeploymentId and the
   rebuild loads that exact artifact.

2. On restart a node recovered its revision from NodeDeploymentState but left the
   driver children + address space empty (and an identical-config redeploy no-ops on
   the unchanged revision), so a rebuilt node served nothing until a config change.
   Bootstrap now calls RestoreApplied: re-spawn drivers, rebuild from the applied
   artifact, re-push SubscribeBulk — no re-ack.

Verified live: recreating the driver nodes auto-restores all 396 galaxy mirror
tags across 40 machines with Good live values, no deploy required.

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/OpcUa/OpcUaPublishActor.cs

@@ -31,7 +31,13 @@ public sealed class OpcUaPublishActor : ReceiveActor
 
     public sealed record AttributeValueUpdate(string NodeId, object? Value, OpcUaQuality Quality, DateTime TimestampUtc);
     public sealed record AlarmStateUpdate(string AlarmNodeId, bool Active, bool Acknowledged, DateTime TimestampUtc);
-    public sealed record RebuildAddressSpace(CorrelationId Correlation);
+    /// <summary>
+    ///     Triggers an address-space rebuild. <paramref name="DeploymentId"/> is the deployment
+    ///     just applied by the host; the rebuild loads THAT artifact so materialisation matches the
+    ///     applied config + the SubscribeBulk pass. It is null only for legacy/dev callers, which
+    ///     fall back to the latest sealed deployment (lags a not-yet-sealed apply by one revision).
+    /// </summary>
+    public sealed record RebuildAddressSpace(CorrelationId Correlation, DeploymentId? DeploymentId = null);
     public sealed record ServiceLevelChanged(byte ServiceLevel);
 
     private readonly IOpcUaAddressSpaceSink _sink;
@@ -196,7 +202,13 @@ public sealed class OpcUaPublishActor : ReceiveActor
 
         try
         {
-            var artifact = LoadLatestArtifact();
+            // Prefer the artifact of the deployment the host just applied — at apply time it is not
+            // yet Sealed, so LoadLatestArtifact would return the PREVIOUS revision and materialise a
+            // stale composition (variables that don't match the SubscribeBulk refs). Fall back to
+            // latest-sealed only for legacy callers that don't carry a DeploymentId.
+            var artifact = msg.DeploymentId is { } depId
+                ? LoadArtifact(depId)
+                : LoadLatestArtifact();
             var composition = DeploymentArtifact.ParseComposition(artifact);
             var plan = Phase7Planner.Compute(_lastApplied, composition);
 
@@ -229,6 +241,25 @@ public sealed class OpcUaPublishActor : ReceiveActor
         }
     }
 
+    /// <summary>Read a specific deployment's artifact blob from ConfigDb (the one just applied,
+    /// which may not be Sealed yet). Empty array on any failure — parser treats it as "no composition".</summary>
+    private byte[] LoadArtifact(DeploymentId deploymentId)
+    {
+        try
+        {
+            using var db = _dbFactory!.CreateDbContext();
+            return db.Deployments.AsNoTracking()
+                .Where(d => d.DeploymentId == deploymentId.Value)
+                .Select(d => d.ArtifactBlob)
+                .FirstOrDefault() ?? Array.Empty<byte>();
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "OpcUaPublish: failed to load artifact for deployment {Id}; rebuild becomes no-op", deploymentId);
+            return Array.Empty<byte>();
+        }
+    }
+
     /// <summary>Read the most recent <c>Sealed</c> deployment's artifact blob from ConfigDb.
     /// Empty array on any failure — the parser treats empty blob as "no composition".</summary>
     private byte[] LoadLatestArtifact()