feat(scripting): PE cache, quarantine-race fix, recovery, readiness for the out-of-process runner (lmxopcua#780 P1)

Second P1 slice of docs/plans/2026-11-09-out-of-process-script-runner-design.md; still opt-in behind
Scripting:Runner=OutOfProcess (InProcess unchanged).

- Compiled-PE cache (design §7, §14 #8): Scripting:Worker:PeCacheDir holds <dir>/pe/<id>.pe entries authenticated
  with HMAC-SHA256 under a per-node random key (<dir>/pe-cache.key, created by the host, 0600/0700 on Unix), handed to
  the worker in Hello. Entry id = SHA-256(compile fingerprint + kind + source); the fingerprint covers the Roslyn
  version, the Core.Scripting build (analyzer, wrapper, stack guard), the sandbox reference set and the runtime. Edited,
  truncated, other-key or renamed entries are rejected, deleted and recompiled; the worker never loads unverified bytes.
  Pruned by recency at startup (30 d / 50 000). ScriptEvaluator splits into CompileToImage + FromImage. Measured on
  40 scripts, restart to every first result: macOS 820 ms no cache / 840 ms empty / 85 ms warm;
  windev (Windows) 9.5 s / 9.4 s / 1.0 s.
- Quarantine race: WorkerConnection runs exit attribution synchronously BEFORE completing the evaluations/loads it held
  (and before Exited), and the shard passes it straight to the runner — a kill strike is in place before the killed
  key's slot is released.
- Supervision: a dead worker restarts by itself after its backoff; Unavailable outcomes carry ScriptRunOutcome.Recovery
  (-> VirtualTagEvalResult.RetryWhen) and the VT actor / Calculation driver re-evaluate once against current inputs when
  it completes. Isolation worker stops after Scripting:Worker:IsolationIdleTimeout (10 min). Keys compiling when a
  worker dies are suspects too (isolation finds a poison compile and quarantines it). Startup orphan sweep by launch
  marker: kills only a process whose marker's host is gone and whose pid + start time + image match.
- Crash-loop circuit (Scripting:Worker:CircuitOpenAfter, 2 min): runner Unavailable, one Error, evaluations answered
  at once while shards keep retrying at the cap.
- Observability (§10): otopcua.script.runner.state, worker.up/inflight/queue_depth/heap_bytes (shard),
  ipc.roundtrip + eval.duration (kind), compile{cache}, isolation.suspects, exits reason=idle. `script-runner` health
  check on the ready tier, at worst Degraded (§14 #12: degraded but still ready).

Left on #780: self-contained worker publish, installer (account, pipe ACL, firewall), docker-dev live drill,
scripted-alarm seam, the §4.5 per-seam batch submit, the §8 perf harness.

Tests: SupervisionTests, PeCacheStoreTests/PeCacheWorkerTests (real workers), ScriptRunnerHealthCheckTests, VT + Calc
recovery seam tests; 14 mutations each turned their test red.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/VirtualTagActor.cs

@@ -51,6 +51,12 @@ public sealed class VirtualTagActor : ReceiveActor, IWithUnboundedStash
     /// when the tag has a <c>TimerIntervalMs</c>.</summary>
     private sealed class TimerTick { public static readonly TimerTick Instance = new(); private TimerTick() { } }
 
+    /// <summary>
+    ///     The out-of-process script runner that could not run this tag's script is serving again (lmxopcua#780 design
+    ///     §9): re-evaluate once against the latest inputs. Private to the actor.
+    /// </summary>
+    private sealed class RunnerRecovered { public static readonly RunnerRecovered Instance = new(); private RunnerRecovered() { } }
+
     /// <summary>The asynchronous evaluation started by <see cref="Evaluate"/> finished. Private to the actor.</summary>
     private sealed record EvaluationCompleted(
         Task<VirtualTagEvalResult> Evaluation, uint WorstInputStatus, DateTime TimestampUtc);
@@ -108,6 +114,8 @@ public sealed class VirtualTagActor : ReceiveActor, IWithUnboundedStash
     private readonly bool _changeTriggered;
     private readonly int? _timerIntervalMs;
     private ICancelable? _timer;
+    // One outstanding RunnerRecovered wait at most: a burst of Unavailable results re-evaluates once (latest-wins).
+    private bool _recoveryArmed;
     // R02:P6 — a script failing on every trigger of a 1 Hz input published one cluster-wide DPS
     // ScriptLogEntry per second per tag; 200 such tags shed everyone's entries out of the bounded
     // telemetry channels. The per-failure entry is now rate-limited per tag (20/min + one summary).
@@ -212,6 +220,11 @@ public sealed class VirtualTagActor : ReceiveActor, IWithUnboundedStash
         Receive<DependencyValueBatch>(OnDependencyBatch);
         Receive<ReassertValue>(_ => OnReassertValue());
         Receive<TimerTick>(_ => Evaluate(DateTime.UtcNow));
+        Receive<RunnerRecovered>(_ =>
+        {
+            _recoveryArmed = false;
+            Evaluate(DateTime.UtcNow);
+        });
         // Only reachable for a completion that outlived its behaviour (a supervision restart mid-evaluation
         // resets the behaviour stack): the incarnation it belonged to is gone, so it is dropped.
         Receive<EvaluationCompleted>(_ => { });
@@ -368,6 +381,21 @@ public sealed class VirtualTagActor : ReceiveActor, IWithUnboundedStash
         ReceiveAny(_ => Stash.Stash());
     }
 
+    /// <summary>
+    ///     A runner failure (BadResourceUnavailable) carries the task that completes when the runner is back: evaluate
+    ///     again then, with whatever inputs are current, instead of holding the Bad until the next input change — which,
+    ///     for a static input, would never come (lmxopcua#780 design §9, "re-evaluated on the shard's return").
+    /// </summary>
+    /// <param name="retryWhen">The recovery task, or null.</param>
+    private void ArmRecovery(Task? retryWhen)
+    {
+        if (retryWhen is null || _recoveryArmed) return;
+        _recoveryArmed = true;
+        var self = Self;
+        retryWhen.ContinueWith(_ => self.Tell(RunnerRecovered.Instance),
+            CancellationToken.None, TaskContinuationOptions.ExecuteSynchronously, TaskScheduler.Default);
+    }
+
     private void OnEvaluatorThrew(Exception ex, DateTime timestampUtc)
     {
         _log.Warning(ex, "VirtualTag {Id}: evaluator threw", _virtualTagId);
@@ -393,6 +421,7 @@ public sealed class VirtualTagActor : ReceiveActor, IWithUnboundedStash
         {
             OnEvaluationFailed(result.Reason ?? "evaluator failure", "Warning", timestampUtc,
                 result.StatusCode ?? OpcUaStatus.BadInternalError);
+            ArmRecovery(result.RetryWhen);
             return;
         }