Merge R2-04 Failure-visibility trio (arch-review round 2) [PR #433]

Findings 01/S-1 (AddressSpaceApplyOutcome failure field + apply.failed logging,
no optimistic success), 06/S-1 (Galaxy write fails closed -> BadCommunicationError
+ #5 revert, no knowingly-lost raw Write), 03/S4 (PrimaryGatePolicy default-deny
unknown-role-multi-driver on all gates + scripted-alarm emit gate). T13/T15 (2-node
live gates) deferred -- T15 is the behavior-affecting S4 live gate, must run in heavy
pass. Clean merge, build clean.

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Observability/OtOpcUaTelemetry.cs

@@ -58,10 +58,24 @@ public static class OtOpcUaTelemetry
         Meter.CreateCounter<long>("otopcua.opcua.sink.write", unit: "{write}",
             description: "Writes that landed in IOpcUaAddressSpaceSink (kind=value|alarm|rebuild).");
 
+    /// <summary>Address-space apply/materialise passes that swallowed at least one sink failure —
+    /// a failed rebuild (kind=rebuild) or per-node materialise failures (kind=nodes). A non-zero rate
+    /// means the running server holds a stale or partially-materialised address space despite a
+    /// reported-successful deploy (archreview 01/S-1).</summary>
+    public static readonly Counter<long> OpcUaApplyFailed =
+        Meter.CreateCounter<long>("otopcua.opcua.apply.failed", unit: "{apply}",
+            description: "Apply/materialise passes with swallowed sink failures (kind=rebuild|nodes).");
+
     public static readonly Counter<long> ServiceLevelChange =
         Meter.CreateCounter<long>("otopcua.redundancy.service_level_change", unit: "{change}",
             description: "OPC UA Server.ServiceLevel transitions emitted by the redundancy state.");
 
+    /// <summary>Inbound operations denied by the Primary data-plane gate (archreview 03/S4) —
+    /// site=write|ack|alarm-emit, reason=secondary|detached|role-unknown.</summary>
+    public static readonly Counter<long> PrimaryGateDenied =
+        Meter.CreateCounter<long>("otopcua.redundancy.primary_gate_denied", unit: "{denial}",
+            description: "Operations denied by the Primary gate (site=write|ack|alarm-emit, reason=secondary|detached|role-unknown).");
+
     // ---------------- Convenience helpers ----------------
 
     /// <summary>