test(717): deferred-event boundary, ACL-filtered promotion refresh, native-ack refusal, effective-URI XML load; docs + T13 overlay

- Wire: an event reported while Active but deferred (#838) is delivered after demotion; the promotion refresh
  withholds an ACL-denied condition (positive control alongside); ConditionRefresh2 and model-change events on the
  Standby; a native Acknowledge is refused and never routed; Warm validates and advertises the EFFECTIVE
  ApplicationUri from an ApplicationConfigPath XML load.
- docs/Redundancy.md: Warm section, the Unset/None i=11314 behaviour (orphan readable by NodeId under Unset,
  deleted under None), instruments; OpcUaServer.md, Configuration.md, security.md, cluster-topology rule.
- docker-dev/docker-compose.warm.yml for the T13 gate (central pair, Mode=Warm).
- Plan: implementation status and the test gaps left for T13/follow-up.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

docker-dev/docker-compose.warm.yml

@@ -0,0 +1,15 @@
+# Gitea #717 T13 live gate: the MAIN central pair under Warm non-transparent redundancy.
+#
+#   docker-dev/compose.sh -f docker-dev/docker-compose.warm.yml up -d --build central-1 central-2
+#
+# The base file already gives each central node its own ApplicationUri (urn:OtOpcUa:central-1|2, equal to the seeded
+# ClusterNode.ApplicationUri) and lists its partner in OpcUa:PeerApplicationUris (lmxopcua#801), which is exactly what
+# Warm validates; this overlay only flips the mode. Both nodes must run a revision-capable (#717) build before either is
+# flipped. Rollback: drop this overlay and recreate central-1/2 (Mode defaults to Unset).
+services:
+  central-1:
+    environment:
+      OpcUa__Redundancy__Mode: "Warm"
+  central-2:
+    environment:
+      OpcUa__Redundancy__Mode: "Warm"