test(alarms): assert reconnect-dropped native alarm does not dead-letter; tighten severity doc

Add AllDeadLetters probe to Native_alarm_during_reconnect_is_dropped_not_forwarded so the
test genuinely guards the Reconnecting state's Receive<NativeAlarmRaised> drop handler —
removing that handler would now cause a dead-letter and fail the assertion (false-negative
gap closed). Reword the ScriptedAlarms.md severity-mapping note: "snaps on the first
transition" → "every transition maps … overriding the authored seed from the first
transition onward", clarifying that MapSeverity runs on every event, not just the first.

docs/ScriptedAlarms.md

@@ -145,8 +145,9 @@ runtime.
 #### Severity mapping
 
 The authored `severity` (1–1000) seeds the OPC UA condition node at materialisation
-time. On the **first native transition** the value snaps to one of four fixed buckets
-via `NativeAlarmProjector.MapSeverity`:
+time. Every native transition maps the driver's `AlarmSeverity` to one of four fixed
+buckets via `NativeAlarmProjector.MapSeverity`, overriding the authored `severity` seed
+from the first transition onward:
 
 | `AlarmSeverity` enum | Projected value |
 |---|---|
@@ -168,8 +169,8 @@ by `OtOpcUaNodeManager.MapSeverity` on each `AlarmStateUpdate` write:
 | ≥ 800 | `High` |
 
 Consequently the four authored buckets land as: Low→`MediumLow`, Medium→`Medium`,
-High→`MediumHigh`, Critical→`High`. The authored `severity` field has no effect after
-the first transition.
+High→`MediumHigh`, Critical→`High`. The authored `severity` field is overridden by
+live driver events on every transition.
 
 ### Runtime flow