feat(alarms): bridge driver comms-loss into scripted-alarm input quality (#481)

Layer 4 of the condition-Quality chain (#477 -> #478). #478 gave a scripted
condition the worst quality of its input tags, but only for inputs whose driver
PUBLISHES a Bad data change. A poll driver whose device goes unreachable
publishes nothing — it raises ConnectivityChanged(false) and goes silent — so
the engine held its last Good value, WorstInputStatus stayed Good, and worse,
AreInputsReady stayed true, so the predicate went on evaluating a stale value
after the source had died.

`DriverHostActor.FanCommsLossToDependencyMux` pushes a synthetic
BadNoCommunication with a null value into the dependency mux for every value ref
the disconnected driver owns.

The issue asked for a driver -> all-tag-refs map to be built for this. It
already exists: `_nodeIdByDriverRef`, keyed (DriverInstanceId, RawPath) and
rebuilt from the composition on every apply. Alarm-bearing tags live in the
separate `_alarmNodeIdByDriverRef` and are deliberately excluded — a native
condition is not a mux value and takes the Part 9 quality path instead.

Nothing is pushed on reconnect, deliberately: publishing Good would assert a
value quality this actor has not observed. Recovery rides the driver's own
republish, and the mechanism was verified rather than assumed — the
Connected -> Reconnecting edge calls DetachSubscription, which nulls the
subscription handle, so the reconnect's ResubscribeDesired builds a FRESH
subscription whose PollGroupEngine initial push runs with forceRaise: true.
Without that detach the poll engine would compare against its retained
LastValues, see an unchanged value, raise nothing, and strand these refs Bad
forever — the value-dedup trap that bit the v3 Batch 4 virtual-tag reassert.

Closes #478 Finding 3, which the above depends on. WorstInputStatus skipped
every input whose VALUE was null as "no data yet" — and Bad-with-no-value is
exactly the shape a comms-lost driver produces, so the skip was hiding the case
that matters most; without this half the fan-out above would be silently inert.
The upstream source now stamps a never-pushed path BadWaitingForInitialData —
the honest Part 4 code for that state — and the engine skips that specific code
rather than every null value.

Deleting the null-skip outright is the obvious fix and is wrong in the other
direction: it makes every not-yet-published input drag its condition Bad at
deploy, flooding the quality path with load-time annotations, which is what the
skip existed to prevent. Both mistakes are pinned by a test pair that goes red
under the opposite error, and both were falsified by reverting the production
code:

  old null-skip restored     -> A_pushed_Bad_carrying_no_value      RED
  null-skip deleted outright -> An_input_that_was_never_pushed      RED
  fan-out call removed       -> the three DriverHostActor tests     RED (1 of 7)

The never-pushed test was vacuous on first writing and is worth recording: the
quality bucket only emits on CHANGE, so the load-time evaluation is the one that
flashes Bad, and subscribing to OnEvent after LoadAsync made the assertion
unfalsifiable — it passed against the broken behaviour. It now subscribes first.

`FakeUpstream.ReadTag` returned 0x80340000 (BadNotConnected) for an unset path,
a different Bad code from production's placeholder. Harmless while any Bad
behaved alike; load-bearing now, so it is aligned and pinned by a reflection
guard asserting the engine's private constant agrees with what the production
source stamps.

Behaviour change to weigh, flagged in the issue and confirmed: virtual tags
computed from a comms-lost input now go Bad too. That follows from using the
shared mux and reads as correct, but it is broader than scripted alarms.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/ScriptedAlarms/DependencyMuxTagUpstreamSourceTests.cs

@@ -1,5 +1,6 @@
 using Shouldly;
 using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Runtime.ScriptedAlarms;
 
@@ -40,6 +41,36 @@ public sealed class DependencyMuxTagUpstreamSourceTests
         snap.StatusCode.ShouldNotBe(0u);
         // Timestamp comes from the injected clock.
         snap.ServerTimestampUtc.ShouldBe(fixedNow);
+
+        // #481: the SPECIFIC code is load-bearing, not merely "some Bad". ScriptedAlarmEngine skips
+        // exactly this code when computing worst-of-input quality, which is how it tells a path nothing
+        // has ever pushed to apart from a driver reporting Bad with no value — the shape a comms-lost
+        // driver produces, and previously indistinguishable from cold start. Any other Bad code here
+        // would make every not-yet-published input drag its condition Bad at deploy.
+        snap.StatusCode.ShouldBe(OpcUaStatus.BadWaitingForInitialData);
+    }
+
+    /// <summary>
+    ///     The engine's private copy of the never-pushed sentinel agrees with the one this source stamps.
+    /// </summary>
+    /// <remarks>
+    ///     <c>Core.ScriptedAlarms</c> deliberately does not reference <c>Commons</c>, so the engine inlines
+    ///     the constant rather than sharing <see cref="OpcUaStatus"/>. The value is fixed by the OPC UA spec
+    ///     so it cannot legitimately drift, but a typo in either copy would silently un-wire #481: the
+    ///     engine would stop recognising the placeholder and every cold-start input would report Bad. Read
+    ///     by reflection because the engine's copy is private — deliberately, since nothing outside the
+    ///     engine should key off it.
+    /// </remarks>
+    [Fact]
+    public void The_engine_agrees_with_this_source_on_the_never_pushed_status_code()
+    {
+        var engineConst = typeof(Core.ScriptedAlarms.ScriptedAlarmEngine)
+            .GetField("StatusNeverPushed", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)
+            .ShouldNotBeNull("ScriptedAlarmEngine.StatusNeverPushed is gone or was renamed — #481's cold-start "
+                + "vs. reported-Bad distinction is wired through it, so this guard must be repointed, not deleted");
+
+        engineConst.GetRawConstantValue().ShouldBe(
+            new DependencyMuxTagUpstreamSource().ReadTag("never/pushed").StatusCode);
     }
 
     [Fact]