refactor(drivers): delete the inert driver-tier recycle machinery (#522)

The tier system was documented, operator-authorable, and inert. Deleted rather than activated,
because its premise is gone rather than merely unused.

"Tier C" meant a driver running out-of-process behind an IDriverSupervisor that could restart its
Host without tearing down the OPC UA session. No such process exists anywhere: Galaxy reaches
MXAccess over gRPC to the external mxaccessgw sidecar (PR 7.2 retired the in-process
Galaxy.Host/Proxy/Shared projects) and FOCAS has run in-process since its managed wire client
landed 2026-04-24. Consistently, IDriverSupervisor had ZERO implementations and there was nothing
for one to implement against.

The issue understated the inertness. It says the Tier-C-only protections never engaged, implying
the Tier A/B parts did. They did not: nothing constructs MemoryTracking, MemoryRecycle or
ScheduledRecycleScheduler outside their own unit tests, so the whole Core/Stability recycle layer
was dead — meaning option (a), "pass real tiers", was never a flag flip. It would have meant
writing the wiring that never existed AND arming it.

Deleted: MemoryTracking, MemoryRecycle, ScheduledRecycleScheduler, IDriverSupervisor, the
vestigial DriverTypeRegistry (referenced only by its own tests), and the RecycleIntervalSeconds
knob — which the AdminUI let an operator author and the parser validated while it configured
nothing.

DriverTier itself SURVIVES and is load-bearing: DriverResilienceOptions.GetTierDefaults supplies
the real per-capability timeout/retry/breaker policies via DriverFactoryRegistry.GetTier and
DriverCapabilityInvokerFactory. Only the isolation-and-recycle layer above it is gone.

Deliberately NOT deleted:

- WedgeDetector came along in the same directory and is equally dead in production, but it is
  tier-agnostic and is not recycle machinery — it only shares the folder. Restored rather than
  swept up in a decision that was not about it.
- IDriver.GetMemoryFootprint() and FlushOptionalCachesAsync() lose their only consumer here.
  Removing them touches all 12 drivers and every test stub, so they are documented as
  consumerless and filed as #525 instead of buried in this diff.

Compatibility: a deployed ResilienceConfig blob still carrying "recycleIntervalSeconds" parses
cleanly (unknown keys are ignored — guarded by a new test, because a blob that suddenly failed to
parse would fall back to tier defaults and silently discard the operator's real overrides), and
the AdminUI's preserve-unknown-keys bag keeps the key rather than rewriting stored config on an
unrelated edit.

The 01/U-6 knob-inertness guard carried an explicit carve-out admitting RecycleIntervalSeconds was
dormant and out of scope; that carve-out is now gone, so the expected set is literally what the
test's name claims.

Note: Host.IntegrationTests has 2 failures (DriverProbeRegistrationTests.is_idempotent,
PrimaryGateFailoverTests) — verified pre-existing by reproducing both on clean master dc9d947b.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/ResilienceFormModelTests.cs

@@ -67,7 +67,7 @@ public class ResilienceFormModelTests
     [Fact]
     public void Partial_override_round_trips()
     {
-        var m = new ResilienceFormModel { RecycleIntervalSeconds = 3600 };
+        var m = new ResilienceFormModel();
         m.Policies["Read"].TimeoutSeconds = 5;
         m.Policies["Read"].RetryCount = 5;
 
@@ -75,16 +75,37 @@ public class ResilienceFormModelTests
         json.ShouldNotBeNull();
 
         var back = ResilienceFormModel.FromJson(json);
-        back.RecycleIntervalSeconds.ShouldBe(3600);
         back.Policies["Read"].TimeoutSeconds.ShouldBe(5);
         back.Policies["Write"].IsEmpty.ShouldBeTrue();
     }
 
+    /// <summary>
+    ///     The removed <c>recycleIntervalSeconds</c> field (Gitea #522) must be PRESERVED in a stored blob
+    ///     rather than stripped, via the model's preserve-unknown-keys contract. Opening a driver's
+    ///     resilience form and saving an unrelated change must not silently rewrite the operator's stored
+    ///     config — dropping the key is a migration decision, not a side effect of a page visit.
+    /// </summary>
+    [Fact]
+    public void The_removed_recycle_key_survives_a_load_save_as_an_unknown_key()
+    {
+        const string stored = """
+            { "recycleIntervalSeconds": 3600, "capabilityPolicies": { "Read": { "retryCount": 5 } } }
+            """;
+
+        var m = ResilienceFormModel.FromJson(stored);
+        m.Policies["Read"].TimeoutSeconds = 9;   // an unrelated edit
+
+        var json = m.ToJson();
+
+        json.ShouldNotBeNull();
+        json.ShouldContain("recycleIntervalSeconds");
+        json.ShouldContain("3600");
+    }
+
     [Fact]
     public void Malformed_json_yields_empty_model()
     {
         var m = ResilienceFormModel.FromJson("{ not valid json");
-        m.RecycleIntervalSeconds.ShouldBeNull();
         m.Policies["Read"].IsEmpty.ShouldBeTrue();
     }