fix(GWC-32): make WorkerClient disposal a terminal transition

DisposeAsync is the third path that completes the outbound, staging and event
channels, but unlike MarkClosed and SetFaulted it left _state untouched. A
client disposed while still Ready therefore kept reporting
IsTerminalState() == false, so a read loop already inside DispatchEnvelope when
the staging channel was completed took StageWorkerEvent's overflow arm: a
spurious ProtocolViolation fault, a worker-event-staging overflow metric, a
redundant kill and a WorkerStopped("ProtocolViolation") metric during an
intentional teardown — on exactly the path an operator inspects after a failed
SessionManager.OpenSessionAsync.

DisposeAsync now takes _syncRoot once, claims _disposed there, and transitions
to Closed only when the state is not already Closed or Faulted, so a
dispose-after-fault keeps Faulted and a double dispose is a no-op. Because the
transition is now real, the dispose path records the worker stop through the
existing RecordWorkerStoppedOnce latch, which also stops the running-worker
gauge leaking when a Ready client is disposed without a prior close or fault.
MarkClosed is deliberately not reused: it would overwrite Faulted with Closed
and would re-run a teardown sequence DisposeAsync performs itself.

The StageWorkerEvent XML doc now names all three completion paths.

Test: DisposeAsync_WhileWorkerIsEmittingEvents_ClosesWithoutFaultingOrOverflowing
disposes a Ready client mid-event-stream and asserts Closed state, zero faults,
zero queue overflows, zero kills and exactly one recorded worker exit. It fails
on the pre-fix code.

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Workers/WorkerClientTests.cs

@@ -14,6 +14,10 @@ public sealed class WorkerClientTests
     private const string SessionId = "session-worker-client";
     private const string Nonce = "nonce-worker-client";
     private const int WorkerProcessId = 4321;
+
+    /// <summary>Upper bound on the events <see cref="EmitEventsUntilStoppedAsync"/> writes.</summary>
+    private const ulong EmittedEventCeiling = 2000;
+
     private static readonly TimeSpan TestTimeout = TimeSpan.FromSeconds(5);
 
     /// <summary>Verifies that StartAsync enters ready state after receiving worker hello and ready messages.</summary>
@@ -560,6 +564,96 @@ public sealed class WorkerClientTests
         Assert.True(process.Disposed);
     }
 
+    /// <summary>
+    ///     GWC-32: disposing a still-<c>Ready</c> client while the worker is emitting events must be
+    ///     an ordinary teardown, not a fault. <c>DisposeAsync</c> completes the same three channels
+    ///     <c>MarkClosed</c> and <c>SetFaulted</c> do, so it must enter a terminal state first;
+    ///     otherwise the read loop — already inside <c>DispatchEnvelope</c> when the staging channel
+    ///     is completed, or reading a stream that is torn down underneath it — misdiagnoses the
+    ///     completed channel as the GWC-24 sustained-backpressure overflow and raises a spurious
+    ///     <c>ProtocolViolation</c> fault, a <c>worker-event-staging</c> overflow metric and a
+    ///     redundant kill during an intentional dispose. The event channel is sized far above the
+    ///     burst so a genuine overflow is impossible, and <c>DisposeAsync</c> awaits its background
+    ///     tasks, so the metrics read afterwards is not racing a late fault.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task DisposeAsync_WhileWorkerIsEmittingEvents_ClosesWithoutFaultingOrOverflowing()
+    {
+        // The burst is capped at EmittedEventCeiling and the staging channel holds 2 x capacity, so
+        // even if every emitted event were staged and none consumed the GWC-24 bound is unreachable:
+        // an overflow metric in this test can only be the dispose-race misdiagnosis.
+        const int capacity = 2048;
+        using GatewayMetrics metrics = new();
+        await using PipePair pipePair = await PipePair.CreateAsync();
+        WorkerClient client = CreateClient(
+            pipePair,
+            new WorkerClientOptions
+            {
+                EventChannelCapacity = capacity,
+                EventChannelFullModeTimeout = TimeSpan.FromMinutes(5),
+                HeartbeatGrace = TimeSpan.FromSeconds(30),
+                HeartbeatCheckInterval = TimeSpan.FromSeconds(30),
+            },
+            metrics: metrics);
+        await CompleteHandshakeAsync(client, pipePair);
+
+        using CancellationTokenSource emitCts = new(TestTimeout);
+        Task emitTask = EmitEventsUntilStoppedAsync(pipePair, emitCts.Token);
+
+        // Proves the read loop is mid-stream — not parked before its first event — when dispose runs.
+        await WaitUntilAsync(() => metrics.GetSnapshot().WorkerEventQueueDepth > 0, TestTimeout);
+
+        await client.DisposeAsync().AsTask().WaitAsync(TestTimeout);
+        await emitCts.CancelAsync();
+        await emitTask.WaitAsync(TestTimeout);
+
+        Assert.Equal(WorkerClientState.Closed, client.State);
+
+        GatewayMetricsSnapshot snapshot = metrics.GetSnapshot();
+        Assert.Equal(0L, snapshot.Faults);
+        Assert.Equal(0L, snapshot.QueueOverflows);
+        Assert.Equal(0L, snapshot.WorkerKills);
+
+        // Disposal is now a terminal transition, so the worker that reached Ready is recorded as
+        // stopped exactly once — the running-worker gauge no longer leaks on this path.
+        Assert.Equal(0, snapshot.WorkersRunning);
+        Assert.Equal(1L, snapshot.WorkerExits);
+    }
+
+    /// <summary>
+    ///     Writes worker events from the fake worker side until cancelled or until
+    ///     <see cref="EmittedEventCeiling"/> events have been written, so the gateway read loop has a
+    ///     continuous stream to dispatch while a test tears the client down. The ceiling keeps the
+    ///     burst structurally below the staging bound the caller configures. Every failure is
+    ///     swallowed: disposal closes the gateway end of the pipe underneath this writer, which is
+    ///     the situation under test rather than a test failure.
+    /// </summary>
+    /// <param name="pipePair">The connected pipe pair whose worker side emits the events.</param>
+    /// <param name="cancellationToken">Stops the emission.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    private static async Task EmitEventsUntilStoppedAsync(
+        PipePair pipePair,
+        CancellationToken cancellationToken)
+    {
+        await Task.Yield();
+        try
+        {
+            for (ulong sequence = 1;
+                sequence <= EmittedEventCeiling && !cancellationToken.IsCancellationRequested;
+                sequence++)
+            {
+                await pipePair.WorkerWriter.WriteAsync(
+                    CreateEventEnvelope(sequence, MxEventFamily.OnDataChange),
+                    cancellationToken);
+            }
+        }
+        catch (Exception)
+        {
+            // Broken pipe, disposed stream or cancellation — all expected once dispose starts.
+        }
+    }
+
     /// <summary>
     /// Verifies that a heartbeat envelope updates the last-heartbeat timestamp and worker
     /// process id. Uses a <see cref="ManualTimeProvider"/> so the timestamp advance is