Independent scripted-alarm scope baseline

This SDK 1.5.378.182-only source probe records the existing opaque-ID behavior tracked by #797. It is deliberately outside the candidate solution and is not a runtime adapter.

Use a clean, separate checkout at original application commit 83ed880e4471344deaf008da9bd028c7e170bdc7. Confirm its package pins before running. Copy only ScriptedScopeProbe.cs temporarily into that checkout's tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/, refusing to overwrite an existing file. Run:

dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests \
  -c Release --filter FullyQualifiedName~BaselineScriptedScopeProbe \
  --logger trx --results-directory /absolute/fresh-baseline-evidence

Preserve the test exit and run the baseline checkout's scripts/ci/assert-not-all-skipped.sh with MIN_EXECUTED=1 against the fresh TRX. Remove only the temporary probe you copied after the run, keeping the source and TRX evidence here/outside the checkout. Verify baseline tracked files remain unchanged. Never load this assembly or old SDK into the candidate process.

The real session has no application-wide roles. The production-valid opaque scripted ID is denied by an Equipment grant, routes nothing, and is then allowed by an explicit Cluster grant. A passing probe pins both outcomes; it does not claim narrow equipment authorization works. The independent candidate counterpart is Sdk2OpaqueScriptedScopeBaselineTests.

Do not make the ID slash-qualified to get a positive result: the current UI rejects /, and that would hide the production scope-resolution defect. A future fix requires reviewed ownership/scope binding without changing opaque IDs or widening permissions. This upgrade preserves the baseline denial and links the separate defect.