feat(alarms): bridge driver comms-loss into scripted-alarm input quality (#481)

Layer 4 of the condition-Quality chain (#477 -> #478). #478 gave a scripted
condition the worst quality of its input tags, but only for inputs whose driver
PUBLISHES a Bad data change. A poll driver whose device goes unreachable
publishes nothing — it raises ConnectivityChanged(false) and goes silent — so
the engine held its last Good value, WorstInputStatus stayed Good, and worse,
AreInputsReady stayed true, so the predicate went on evaluating a stale value
after the source had died.

`DriverHostActor.FanCommsLossToDependencyMux` pushes a synthetic
BadNoCommunication with a null value into the dependency mux for every value ref
the disconnected driver owns.

The issue asked for a driver -> all-tag-refs map to be built for this. It
already exists: `_nodeIdByDriverRef`, keyed (DriverInstanceId, RawPath) and
rebuilt from the composition on every apply. Alarm-bearing tags live in the
separate `_alarmNodeIdByDriverRef` and are deliberately excluded — a native
condition is not a mux value and takes the Part 9 quality path instead.

Nothing is pushed on reconnect, deliberately: publishing Good would assert a
value quality this actor has not observed. Recovery rides the driver's own
republish, and the mechanism was verified rather than assumed — the
Connected -> Reconnecting edge calls DetachSubscription, which nulls the
subscription handle, so the reconnect's ResubscribeDesired builds a FRESH
subscription whose PollGroupEngine initial push runs with forceRaise: true.
Without that detach the poll engine would compare against its retained
LastValues, see an unchanged value, raise nothing, and strand these refs Bad
forever — the value-dedup trap that bit the v3 Batch 4 virtual-tag reassert.

Closes #478 Finding 3, which the above depends on. WorstInputStatus skipped
every input whose VALUE was null as "no data yet" — and Bad-with-no-value is
exactly the shape a comms-lost driver produces, so the skip was hiding the case
that matters most; without this half the fan-out above would be silently inert.
The upstream source now stamps a never-pushed path BadWaitingForInitialData —
the honest Part 4 code for that state — and the engine skips that specific code
rather than every null value.

Deleting the null-skip outright is the obvious fix and is wrong in the other
direction: it makes every not-yet-published input drag its condition Bad at
deploy, flooding the quality path with load-time annotations, which is what the
skip existed to prevent. Both mistakes are pinned by a test pair that goes red
under the opposite error, and both were falsified by reverting the production
code:

  old null-skip restored     -> A_pushed_Bad_carrying_no_value      RED
  null-skip deleted outright -> An_input_that_was_never_pushed      RED
  fan-out call removed       -> the three DriverHostActor tests     RED (1 of 7)

The never-pushed test was vacuous on first writing and is worth recording: the
quality bucket only emits on CHANGE, so the load-time evaluation is the one that
flashes Bad, and subscribing to OnEvent after LoadAsync made the assertion
unfalsifiable — it passed against the broken behaviour. It now subscribes first.

`FakeUpstream.ReadTag` returned 0x80340000 (BadNotConnected) for an unset path,
a different Bad code from production's placeholder. Harmless while any Bad
behaved alike; load-bearing now, so it is aligned and pinned by a reflection
guard asserting the engine's private constant agrees with what the production
source stamps.

Behaviour change to weigh, flagged in the issue and confirmed: virtual tags
computed from a comms-lost input now go Bad too. That follows from using the
shared mux and reads as correct, but it is broader than scripted alarms.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.Tests/FakeUpstream.cs

@@ -38,11 +38,23 @@ public sealed class FakeUpstream : ITagUpstreamSource
         }
     }
 
-    /// <summary>Reads the current value of a tag, or returns a bad-status snapshot if not set.</summary>
+    /// <summary>
+    ///     OPC UA <c>BadWaitingForInitialData</c> — the status a never-pushed path reports, matching what
+    ///     the production <c>DependencyMuxTagUpstreamSource</c> stamps.
+    ///     <para>This used to be <c>0x80340000</c> (<c>BadNotConnected</c>), a different Bad code from the
+    ///     one production uses. That drift was invisible while <c>WorstInputStatus</c> skipped every
+    ///     null-valued entry — any Bad code behaved the same. #481 made the specific code load-bearing (it
+    ///     is how cold start is told apart from a driver reporting Bad), so a fake disagreeing with
+    ///     production here would let every alarm with an unset input report Bad in tests and Good in the
+    ///     real runtime, or vice versa.</para>
+    /// </summary>
+    public const uint StatusNeverPushed = 0x80320000u;
+
+    /// <summary>Reads the current value of a tag, or returns a never-pushed snapshot if not set.</summary>
     /// <param name="path">The tag path to read.</param>
     public DataValueSnapshot ReadTag(string path)
         => _values.TryGetValue(path, out var v) ? v
-            : new DataValueSnapshot(null, 0x80340000u, null, DateTime.UtcNow);
+            : new DataValueSnapshot(null, StatusNeverPushed, null, DateTime.UtcNow);
 
     /// <summary>Subscribes an observer to tag changes for the given path.</summary>
     /// <param name="path">The tag path to subscribe to.</param>