feat(scripting): ScriptRunGuard quarantines runaway scripts across every seam (E1)

A timed-out script is abandoned, not stopped, and every seam re-ran it on the
next trigger, leaking one pool thread per trigger (R03:1.1, R05:2, R07:L1).
A shared ScriptRunGuard, keyed per script instance, now:

- refuses a run while that script's previous orphan is still executing
  (Bad "previous evaluation still running" + otopcua.script.run_refused);
- quarantines after 3 consecutive non-completions or an allocation-budget
  breach (sampled with GC.GetAllocatedBytesForCurrentThread; default 64 MB):
  no further dispatch, Bad quality, one Error, otopcua.script.quarantined,
  cleared on source change / redeploy / reset;
- starts the budget clock when the pool picks the run up, so starvation is
  no longer charged to the script (R07:P5), and cancels the evaluator token
  on timeout.

Wired into RoslynVirtualTagEvaluator, CalculationEvaluator (new async
EvaluateAsync; the driver's pump and timer ticks now await the run behind a
SemaphoreSlim gate) and ScriptedAlarmEngine (a non-completing predicate
holds state and annotates the condition BadInternalError). ScriptingOptions
(Scripting:MaxAllocBytesPerRun, Scripting:QuarantineAfterConsecutiveTimeouts)
carries the knobs; the Calculation driver config accepts the same two keys.

Tests: guard unit suite (incl. the 30-trigger runaway leaving one orphan with
a healthy sibling as positive control), per-seam refusal/quarantine/reset
tests. The S12 race test now uses one vtag id per loop: twelve concurrent
evaluations of ONE id is a shape production never produces and the guard
refuses by design.

Refs #734

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/CalculationDriverFactoryExtensions.cs

@@ -71,11 +71,22 @@ public static class CalculationDriverFactoryExtensions
             ?? throw new InvalidOperationException(
                 $"Calculation driver config for '{driverInstanceId}' deserialised to null");
 
+        // Run-guard knobs are optional and default to the node-wide ScriptingOptions defaults; only an
+        // explicitly authored key overrides one (so a config carrying neither binds Scripting = null).
+        ScriptingOptions? scripting = null;
+        if (dto.MaxAllocBytesPerRun is not null || dto.QuarantineAfterConsecutiveTimeouts is not null)
+        {
+            scripting = new ScriptingOptions();
+            if (dto.MaxAllocBytesPerRun is { } alloc) scripting.MaxAllocBytesPerRun = alloc;
+            if (dto.QuarantineAfterConsecutiveTimeouts is { } n) scripting.QuarantineAfterConsecutiveTimeouts = n;
+        }
+
         var options = new CalculationDriverOptions
         {
             RawTags = dto.RawTags is { Count: > 0 } ? [.. dto.RawTags] : [],
             RunTimeout = dto.RunTimeoutMs is { } ms && ms > 0
                 ? TimeSpan.FromMilliseconds(ms) : TimeSpan.FromSeconds(2),
+            Scripting = scripting,
         };
 
         return new CalculationDriver(
@@ -92,5 +103,11 @@ public static class CalculationDriverFactoryExtensions
 
         /// <summary>Optional per-script evaluation wall-clock budget override, in milliseconds (default 2000).</summary>
         public int? RunTimeoutMs { get; init; }
+
+        /// <summary>Optional run-guard allocation budget per script run, in bytes (default 64 MB; ≤ 0 disables).</summary>
+        public long? MaxAllocBytesPerRun { get; init; }
+
+        /// <summary>Optional run-guard quarantine threshold: consecutive non-completions before a tag's script stops being evaluated (default 3).</summary>
+        public int? QuarantineAfterConsecutiveTimeouts { get; init; }
     }
 }