fix(opcua): #855 review 2 — frozen replay skips non-live conditions; per-hop ACL resolution; drain never inline

- QueueFrozenReplay's verdict refuses a condition a deploy removed or replaced
  since the cut (Server-object and folder), so the cut path cannot replay a
  ghost or judge a replaced scripted alarm on its old folder.
- DeliverToNotifierItems resolves the #826 decision's item-independent part
  (live condition, notifier check, scopes) once per hop; only the grant and
  SDK role checks stay per item.
- A deferred delivery's drain starts on the pool, never inline under Lock.
- Test: a condition removed between the cut and its replay (folder + Server
  object).

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

docs/security.md

@@ -917,7 +917,8 @@ Behaviours worth knowing before enabling it:
     event type, source), so a refresh of a folder item could still be followed by older events. Now, at every notifier
     the node manager owns, the walk serves the attached items itself (`DeliverToNotifierItems`), exactly as it serves
     Server-object items: the SDK's audit guard, the verdict through `INodeManager3.ValidateEventRolePermissions` (SDK
-    type/source `ReceiveEvents` + the #826 decision under enforcement) **per event, uncached**, then the item's gate and
+    type/source `ReceiveEvents` + the #826 decision under enforcement — its item-independent part, the live condition,
+    the notifier check and the visibility scopes, resolved once per hop) **per event, uncached**, then the item's gate and
     cut, then `QueueEvent`. The `MonitoredNode2` stays for item attachment and for what still uses its channel (a
     condition's SDK method audit events, data-change items on the folder), so `InvalidateFolderEventVerdicts` stays.
     - **No notifier of ours defers any more.** `QueueEvent` never waits for a consumer (the item queue discards oldest at