chore(docker-dev): seed OpcUaClient driver for opc-plc + doc native-alarm source semantics (#619)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/OpcUaClient.md

@@ -91,6 +91,13 @@ rather than surfacing as a runtime surprise.
 | `IAlarmSource` | `SubscribeAlarmsAsync` (EventFilter) + `AcknowledgeAsync` | Subscribes to upstream alarm/condition events and forwards acks |
 | `IHistoryProvider` | `ReadRawAsync` / `ReadProcessedAsync` / `ReadAtTimeAsync` → `Session.HistoryReadAsync` | **Unique to this driver** — passthrough history read against the upstream server |
 
+> **Native alarms (#619).** An alarm raw tag is `TagConfig` `{ "nodeId": "<upstream SourceNode>", "alarm": {...} }`.
+> The host subscribes with RawPaths and routes on (driver, RawPath), so the driver matches each event's
+> `SourceNode` against the tag's authored `nodeId` and reports the **RawPath** as `ConditionId`; the upstream
+> condition node (last seen per RawPath) is what `Acknowledge` is called on. `nodeId` must therefore be the
+> event's *source*, not the condition node. docker-dev seeds an opc-plc driver (`MAIN-opcua`); the alarm tag is
+> created only when `@OpcPlcAlarmSourceNodeId` is set in `docker-dev/seed/seed-clusters.sql`.
+
 > This driver does **not** implement `IRediscoverable` — there is no
 > push-driven rediscovery signal from a remote OPC UA server in this driver.
 > `IHistoryProvider` is implemented by no other driver; history reads for every