feat(scripting): PE cache, quarantine-race fix, recovery, readiness for the out-of-process runner (lmxopcua#780 P1)

Second P1 slice of docs/plans/2026-11-09-out-of-process-script-runner-design.md; still opt-in behind
Scripting:Runner=OutOfProcess (InProcess unchanged).

- Compiled-PE cache (design §7, §14 #8): Scripting:Worker:PeCacheDir holds <dir>/pe/<id>.pe entries authenticated
  with HMAC-SHA256 under a per-node random key (<dir>/pe-cache.key, created by the host, 0600/0700 on Unix), handed to
  the worker in Hello. Entry id = SHA-256(compile fingerprint + kind + source); the fingerprint covers the Roslyn
  version, the Core.Scripting build (analyzer, wrapper, stack guard), the sandbox reference set and the runtime. Edited,
  truncated, other-key or renamed entries are rejected, deleted and recompiled; the worker never loads unverified bytes.
  Pruned by recency at startup (30 d / 50 000). ScriptEvaluator splits into CompileToImage + FromImage. Measured on
  40 scripts, restart to every first result: macOS 820 ms no cache / 840 ms empty / 85 ms warm;
  windev (Windows) 9.5 s / 9.4 s / 1.0 s.
- Quarantine race: WorkerConnection runs exit attribution synchronously BEFORE completing the evaluations/loads it held
  (and before Exited), and the shard passes it straight to the runner — a kill strike is in place before the killed
  key's slot is released.
- Supervision: a dead worker restarts by itself after its backoff; Unavailable outcomes carry ScriptRunOutcome.Recovery
  (-> VirtualTagEvalResult.RetryWhen) and the VT actor / Calculation driver re-evaluate once against current inputs when
  it completes. Isolation worker stops after Scripting:Worker:IsolationIdleTimeout (10 min). Keys compiling when a
  worker dies are suspects too (isolation finds a poison compile and quarantines it). Startup orphan sweep by launch
  marker: kills only a process whose marker's host is gone and whose pid + start time + image match.
- Crash-loop circuit (Scripting:Worker:CircuitOpenAfter, 2 min): runner Unavailable, one Error, evaluations answered
  at once while shards keep retrying at the cap.
- Observability (§10): otopcua.script.runner.state, worker.up/inflight/queue_depth/heap_bytes (shard),
  ipc.roundtrip + eval.duration (kind), compile{cache}, isolation.suspects, exits reason=idle. `script-runner` health
  check on the ready tier, at worst Degraded (§14 #12: degraded but still ready).

Left on #780: self-contained worker publish, installer (account, pipe ACL, firewall), docker-dev live drill,
scripted-alarm seam, the §4.5 per-seam batch submit, the §8 perf harness.

Tests: SupervisionTests, PeCacheStoreTests/PeCacheWorkerTests (real workers), ScriptRunnerHealthCheckTests, VT + Calc
recovery seam tests; 14 mutations each turned their test red.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/Server/ZB.MOM.WW.OtOpcUa.ScriptWorker/WorkerHost.cs

@@ -44,6 +44,7 @@ internal sealed class WorkerHost
     private int _queueCapacity = 4096;
     private TimeSpan _hardGrace = TimeSpan.FromSeconds(1);
     private TimeSpan _heartbeatInterval = TimeSpan.FromSeconds(1);
+    private ScriptPeCacheStore? _peCache;
     private long _seq;
 
     public WorkerHost(NamedPipeClientStream pipe, string nonce, int parentPid)
@@ -102,6 +103,11 @@ internal sealed class WorkerHost
         if (hello.QueueCapacity > 0) _queueCapacity = (int)hello.QueueCapacity;
         if (hello.HardGraceMs > 0) _hardGrace = TimeSpan.FromMilliseconds(hello.HardGraceMs);
         if (hello.HeartbeatIntervalMs > 0) _heartbeatInterval = TimeSpan.FromMilliseconds(hello.HeartbeatIntervalMs);
+        if (!string.IsNullOrEmpty(hello.PeCacheDir) && hello.PeCacheKey.Length == ScriptPeCacheStore.KeyLength)
+        {
+            // Design §7: the host owns the key; it reaches us only here, never through the environment or a file.
+            _peCache = new ScriptPeCacheStore(hello.PeCacheDir, hello.PeCacheKey.ToByteArray());
+        }
     }
 
     private void StartBackground(int evalThreads)
@@ -181,7 +187,8 @@ internal sealed class WorkerHost
             var outcome = new LoadOutcome { Key = script.Key, Ok = true };
             try
             {
-                var loaded = LoadedScript.Compile(script);
+                var loaded = LoadedScript.Load(script, _peCache, out var cache);
+                outcome.Cache = cache;
                 if (_scripts.TryRemove(script.Key, out var previous)) previous.Dispose();
                 _scripts[script.Key] = loaded;
             }
@@ -499,15 +506,52 @@ internal sealed class WorkerHost
 
         public string[] InputPaths { get; }
 
-        public static LoadedScript Compile(ScriptSource source) => source.Kind switch
+        /// <summary>
+        ///     Loads a script: from a verified PE cache entry when there is one (Roslyn is not entered), otherwise by
+        ///     compiling it and writing the entry (design §7). A compile error is never cached — the host's negative
+        ///     cache covers that — and an entry that fails verification is deleted by the store and recompiled.
+        /// </summary>
+        public static LoadedScript Load(ScriptSource source, ScriptPeCacheStore? cache, out PeCache how) => source.Kind switch
         {
             ContextKind.VirtualTag or ContextKind.Calculation => new LoadedScript(
-                [.. source.InputPaths], ScriptEvaluator<VirtualTagContext, object?>.Compile(source.Source), null),
+                [.. source.InputPaths], Load<VirtualTagContext, object?>(source, cache, out how), null),
             ContextKind.AlarmPredicate => new LoadedScript(
-                [.. source.InputPaths], null, ScriptEvaluator<AlarmPredicateContext, bool>.Compile(source.Source)),
+                [.. source.InputPaths], null, Load<AlarmPredicateContext, bool>(source, cache, out how)),
             _ => throw new ScriptWorkerProtocolException($"unknown script kind {source.Kind}"),
         };
 
+        private static ScriptEvaluator<TContext, TResult> Load<TContext, TResult>(ScriptSource source, ScriptPeCacheStore? cache,
+            out PeCache how) where TContext : ScriptContext
+        {
+            if (cache is null)
+            {
+                how = PeCache.None;
+                return ScriptEvaluator<TContext, TResult>.Compile(source.Source);
+            }
+
+            var id = ScriptPeCacheStore.EntryId(ScriptEvaluator<TContext, TResult>.CacheFingerprint, (int)source.Kind, source.Source);
+            var lookup = cache.TryRead(id, out var image);
+            if (lookup == PeCacheLookup.Hit)
+            {
+                try
+                {
+                    how = PeCache.Hit;
+                    return ScriptEvaluator<TContext, TResult>.FromImage(image!);
+                }
+                catch (Exception ex) when (ex is BadImageFormatException or InvalidOperationException or TypeLoadException or MissingMethodException)
+                {
+                    // Authenticated but unloadable: only possible across a runtime change the fingerprint missed.
+                    try { File.Delete(cache.EntryPath(id)); } catch (IOException) { }
+                    lookup = PeCacheLookup.Rejected;
+                }
+            }
+
+            var compiled = ScriptEvaluator<TContext, TResult>.CompileToImage(source.Source);
+            cache.TryWrite(id, compiled);
+            how = lookup == PeCacheLookup.Rejected ? PeCache.Rejected : PeCache.Miss;
+            return ScriptEvaluator<TContext, TResult>.FromImage(compiled);
+        }
+
         public object? Run(IReadOnlyDictionary<string, DataValueSnapshot> inputs, ILogger logger, Func<DateTime> clock,
             CancellationToken ct, out bool isPredicate)
         {