fix(scripting): review minors: configured limit in summaries, dispose gate/CTS, validator, docs (fix round 1)

- ScriptLogRateLimiter.LimitPerWindow. The ScriptLogTopicSink and
  VirtualTagActor summaries now print the configured limit, not
  DefaultLimitPerWindow. Tests assert "limit N/window" for a non-default
  N.
- CalculationDriver.Dispose cancels, then takes _evalGate (bounded 2 s)
  and disposes the gate and _evalCts. The pump and timer ticks enter the
  gate through TryEnterEvalGateAsync, which stops cleanly once the
  driver is disposed. Test: Dispose with a 6 s runaway run in flight
  returns promptly, disposes both, and a late trigger is harmless.
- ScriptedAlarmEngine captures _shutdownToken once and disposes
  _shutdownCts in Dispose when every drained task has completed. A task
  stuck past the grace leaves the CTS to the GC. Lifecycle tests assert
  the disposal.
- DraftValidator: CalculationNoEffectiveTrigger is skipped for a
  change-triggered tag whose scriptId does not resolve. That case is
  already CalculationScriptMissing or CalculationScriptNotFound, and
  there are no reads to count. Both existing tests now assert the
  absence (red before the change).
- docs/VirtualTags.md: System.Threading is denied as a whole namespace,
  with an allow-list; the type list is now accurate (Unsafe,
  RuntimeHelpers, and the ForbiddenMembers on System.Type); the resource
  limits section covers the run guard and the allocation budget.
  docs/ScriptEditor.md: accurate deny-list and a new "Runtime safety"
  section covering timeout, refusal, quarantine after 3 timeouts,
  allocation budget, lifting, and rate-limit summaries that appear only
  on the source's next entry after a burst then quiet.

Refs #734

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/CalculationDriver.cs

@@ -111,7 +111,7 @@ public sealed class CalculationDriver : IDriver, IDependencyConsumer, ISubscriba
     private CalculationTimerScheduler? _timers;
     private volatile bool _running;
     private DateTime? _lastComputeUtc;
-    private bool _disposed;
+    private volatile bool _disposed;
 
     /// <summary>Occurs when a calc tag's computed value changes (or transitions Good↔Bad).</summary>
     public event EventHandler<DataChangeEventArgs>? OnDataChange;
@@ -538,7 +538,7 @@ public sealed class CalculationDriver : IDriver, IDependencyConsumer, ISubscriba
 
             // _evalGate (never _lock) is held across the run, so the pump and the timer ticks still
             // evaluate one at a time while no host thread can block behind a script.
-            await _evalGate.WaitAsync().ConfigureAwait(false);
+            if (!await TryEnterEvalGateAsync().ConfigureAwait(false)) return; // disposed
             try
             {
                 await RunEvaluationAsync(next).ConfigureAwait(false);
@@ -566,7 +566,7 @@ public sealed class CalculationDriver : IDriver, IDependencyConsumer, ISubscriba
         PendingEvaluation? prepared;
         lock (_lock) prepared = PrepareEvaluation(rawPath, DateTime.UtcNow);
         if (prepared is null) return;
-        await _evalGate.WaitAsync().ConfigureAwait(false);
+        if (!await TryEnterEvalGateAsync().ConfigureAwait(false)) return; // disposed
         try
         {
             await RunEvaluationAsync(prepared).ConfigureAwait(false);
@@ -577,6 +577,25 @@ public sealed class CalculationDriver : IDriver, IDependencyConsumer, ISubscriba
         }
     }
 
+    /// <summary>Acquire <see cref="_evalGate"/>; false once <see cref="Dispose"/> has disposed it (a pump
+    /// iteration or timer tick that raced the teardown simply stops).</summary>
+    private async Task<bool> TryEnterEvalGateAsync()
+    {
+        if (_disposed) return false;
+        try
+        {
+            await _evalGate.WaitAsync().ConfigureAwait(false);
+        }
+        catch (ObjectDisposedException)
+        {
+            return false;
+        }
+        if (!_disposed) return true;
+        // Dispose landed while we waited (it gave up the gate without disposing it): back out.
+        _evalGate.Release();
+        return false;
+    }
+
     /// <summary>Run one prepared evaluation and publish the outcome. MUST be called under
     /// <see cref="_evalGate"/> and NOT under <see cref="_lock"/>: the script run is the whole point of the
     /// split, and the script log + <see cref="OnDataChange"/> fan-out both invoke subscriber code.</summary>
@@ -784,11 +803,33 @@ public sealed class CalculationDriver : IDriver, IDependencyConsumer, ISubscriba
         StopTimers();
         lock (_lock) _pending.Clear();
         // Cancel an awaited run first (the guard lets the caller's cancel win over the timeout), then drop
-        // the compiled scripts. The CTS is not disposed: a pump mid-await may still read its token.
+        // the compiled scripts.
         try { _evalCts.Cancel(); } catch (ObjectDisposedException) { }
         _evaluator.Dispose();
+
+        // Then take the gate: once Dispose holds it no evaluation is mid-run (the token — read only under
+        // the gate — has been observed), so the gate and the CTS can be disposed. A late pump iteration or
+        // timer tick sees _disposed / an ObjectDisposedException in TryEnterEvalGateAsync and stops. Bounded:
+        // a run that ignores the cancel cannot hold Dispose; in that case both are left to the GC.
+        if (_evalGate.Wait(DisposeGateTimeout))
+        {
+            _evalCts.Dispose();
+            _evalGate.Dispose();
+            _evalResourcesDisposed = true;
+        }
+        else
+        {
+            _logger.LogWarning("Calculation {Driver}: an evaluation did not release the gate within {Timeout} of Dispose; leaving it to the GC",
+                _driverInstanceId, DisposeGateTimeout);
+        }
     }
 
+    private static readonly TimeSpan DisposeGateTimeout = TimeSpan.FromSeconds(2);
+    private volatile bool _evalResourcesDisposed;
+
+    /// <summary>Test hook — whether <see cref="Dispose"/> disposed the evaluation gate and its CTS.</summary>
+    internal bool EvalResourcesDisposedForTest => _evalResourcesDisposed;
+
     /// <summary>Per-tag published state (guarded by <see cref="_lock"/>).</summary>
     private sealed class TagState
     {