feat(scripting): expose the run token to scripts as ctx.CancellationToken

ScriptContext.CancellationToken is backed by an AsyncLocal that
ScriptEvaluator.RunAsync scopes around the compiled delegate, so it is
exactly the token ScriptRunGuard cancels on timeout. A polling script
can now end its own abandoned run and free the slot. AsyncLocal rather
than a field because the scripted-alarm engine reuses one context per
alarm: an orphan keeps seeing its own cancelled token. The scoping
entry point is internal (IVT to Core.Scripting) so a script cannot
replace its own token.

Editor parity: ScriptAnalysisService dot-completion now walks the
receiver's base chain (instance members only, stopping before
System.Object). Before this, a member declared only on ScriptContext
compiled and published but never completed. DiagnoseTests pins the
member as allow-listed; CompletionTests pins the completion.

Refs #731 #734
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/ScriptAnalysis/DiagnoseTests.cs

@@ -48,6 +48,7 @@ public sealed class DiagnoseTests
     [InlineData("""var x = 41; System.Threading.Interlocked.Increment(ref x); return x;""")]
     [InlineData("""var x = 42; return System.Threading.Volatile.Read(ref x);""")]
     [InlineData("""object o = 42; return o.GetType().IsValueType ? 1 : 0;""")]
+    [InlineData("""ctx.CancellationToken.ThrowIfCancellationRequested(); return ctx.CancellationToken.IsCancellationRequested ? 1 : 0;""")]
     public void Allow_listed_forms_are_not_flagged_in_the_editor(string code)
         => Diag(code).ShouldBeEmpty();