fix(scripting): give scripted-alarm predicates the configured run budget, not 250 ms (lmxopcua#779)

DriverHostActor built ScriptedAlarmEngine without a scriptTimeout, so every
production alarm predicate fell back to TimedScriptEvaluator.DefaultTimeout
(250 ms) while virtual tags and Calculation tags ran on 2 s. History shows no
decision behind it: 250 ms is the generic Phase-7 A.4 default, the VT
evaluator moved to 2 s in F8b (219d10a2) and the alarm engine was simply never
given a value.

- New node-wide Scripting:RunTimeout (default 2 s, clamped to (0, 60 s],
  non-positive -> default, each clamp a startup Warning) on ScriptingOptions.
- The VT evaluator and the alarm engine default to it; DriverHostActor now
  builds the engine through CreateScriptedAlarmEngine, which passes it
  explicitly. Calculation keeps its per-driver runTimeoutMs.
- Docs: ScriptEditor (config table), ScriptedAlarms, VirtualTags.

Tests: ScriptedAlarmEngineBudgetTests (a 600 ms predicate now completes and
activates; default and configured budgets), ScriptedAlarmEngineBudgetWiringTests
(the host-built engine), ScriptingOptionsBindingTests (bind + clamps). The
engine and wiring tests fail with the old 250 ms default restored.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/Server/ZB.MOM.WW.OtOpcUa.Host/Engines/RoslynVirtualTagEvaluator.cs

@@ -57,7 +57,8 @@ public sealed class RoslynVirtualTagEvaluator : IVirtualTagEvaluator, IScriptCac
     /// <summary>Initializes a new RoslynVirtualTagEvaluator with the given loggers and optional timeout.</summary>
     /// <param name="logger">Logger for recording compilation and execution errors (host diagnostics).</param>
     /// <param name="scriptRoot">Root script logger; user <c>ctx.Logger.*</c> output flows through this to the Script-log page.</param>
-    /// <param name="runTimeout">Maximum execution time for each script; defaults to 2 seconds if not specified.</param>
+    /// <param name="runTimeout">Maximum execution time for each script; null ⇒ <see cref="ScriptingOptions.RunTimeout"/>
+    /// of <paramref name="scripting"/> (2 s by default).</param>
     /// <param name="scripting">Run-guard budget + quarantine threshold (the <c>Scripting</c> section); null ⇒ defaults.</param>
     public RoslynVirtualTagEvaluator(
         ILogger<RoslynVirtualTagEvaluator> logger,
@@ -67,7 +68,7 @@ public sealed class RoslynVirtualTagEvaluator : IVirtualTagEvaluator, IScriptCac
     {
         _logger = logger;
         _scriptRoot = (scriptRoot ?? throw new ArgumentNullException(nameof(scriptRoot))).Logger;
-        _runTimeout = runTimeout ?? TimeSpan.FromSeconds(2);
+        _runTimeout = runTimeout ?? (scripting ?? new ScriptingOptions()).Sanitized(out _).RunTimeout;
         _guard = new ScriptRunGuard(scripting, _scriptRoot);
     }
 

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -367,8 +367,9 @@ if (hasDriver)
     // F8b — production virtual-tag evaluator (Roslyn-compiled scripts cached per expression).
     // Replaces the F8-default NullVirtualTagEvaluator so VirtualTagActor evaluates real user
     // scripts at runtime.
-    // Node-wide script run-guard knobs (Scripting:MaxAllocBytesPerRun / QuarantineAfterConsecutiveTimeouts /
-    // StuckOrphanQuarantineFactor). Bound once and clamped into sane ranges here, so an absurd value is a startup
+    // Node-wide script run-guard knobs (Scripting:RunTimeout / MaxAllocBytesPerRun / QuarantineAfterConsecutiveTimeouts /
+    // StuckOrphanQuarantineFactor). RunTimeout is the per-run budget of virtual tags and scripted-alarm predicates
+    // (lmxopcua#779 — the alarm engine used to fall back to a 250 ms default instead). Bound once and clamped into sane ranges here, so an absurd value is a startup
     // Warning rather than an OverflowException inside a script run. The one instance is shared by every script
     // seam on the node: the virtual-tag evaluator below, the scripted-alarm engine (DriverHostActor, via
     // WithOtOpcUaRuntimeActors) and every Calculation driver (DriverFactoryBootstrap).

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -1248,14 +1248,34 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
                 () =>
                 {
                     var upstream = new DependencyMuxTagUpstreamSource();
-                    var engine = new ScriptedAlarmEngine(
-                        upstream, store, new ScriptLoggerFactory(scriptLogger), scriptLogger, scripting: scripting);
-                    return (upstream, engine);
+                    return (upstream, CreateScriptedAlarmEngine(upstream, store, scriptLogger, scripting));
                 },
                 _localNode, telemetryHub: _telemetryHub),
             "scripted-alarm-host");
     }
 
+    /// <summary>
+    ///     Builds the scripted-alarm engine the alarm host owns, with the node's <c>Scripting:RunTimeout</c> as the
+    ///     per-predicate budget. lmxopcua#779: the engine used to be built without a budget and fell back to the
+    ///     250 ms <c>TimedScriptEvaluator.DefaultTimeout</c>, an eighth of what a virtual tag reading the same
+    ///     inputs gets. Passed explicitly (not left to the engine's own null default) so the host is the one place
+    ///     that decides it.
+    /// </summary>
+    /// <param name="upstream">The engine's upstream tag source.</param>
+    /// <param name="store">The condition-state store.</param>
+    /// <param name="scriptLogger">The root script logger.</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> options; null ⇒ defaults.</param>
+    /// <returns>A new, unloaded engine.</returns>
+    internal static ScriptedAlarmEngine CreateScriptedAlarmEngine(
+        ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.ITagUpstreamSource upstream, IAlarmStateStore store,
+        Serilog.ILogger scriptLogger, ScriptingOptions? scripting)
+    {
+        var budget = (scripting ?? new ScriptingOptions()).Sanitized(out _).RunTimeout;
+        return new ScriptedAlarmEngine(
+            upstream, store, new ScriptLoggerFactory(scriptLogger), scriptLogger,
+            scriptTimeout: budget, scripting: scripting);
+    }
+
     private void Bootstrap()
     {
         // Per-cluster mesh Phase 3: a FetchAndCache node NEVER reads central SQL for config, at boot