test+fix: eliminate Windows full-suite temp-file-lock flakiness

Full-host tests passed in isolation but failed 2-4/run under parallel execution on
Windows with 'the process cannot access the file ... because it is being used by
another process' (macOS never sees it — Unix deletes open files). Two shared-state
parallel collisions, discovered while verifying TST-08:

1. Self-signed cert generation. GatewayTlsBootstrapTests sets process-global
   Kestrel/TLS env vars that GatewayApplication.Build reads; a parallel host-building
   test inherits them mid-run and both generate a cert at the same path, racing on the
   fixed-name '<path>.tmp'. Fixes:
   - SelfSignedCertificateProvider: stage the PFX in a unique '<path>.<guid>.tmp' instead
     of a fixed name, so concurrent/interrupted writers never collide on the temp file
     (real robustness: two instances or a restart-during-write no longer clash). The
     final atomic Move (last-writer-wins) still yields an equivalent cert.
   - TestHostEnvironmentInitializer: default MxGateway__Tls__SelfSignedCertPath to a
     per-process temp path so the suite never writes the shared ProgramData default or
     fights the deployed service; first host-building test generates, the rest load it.
   - GatewayTlsBootstrapTests: [Collection] with DisableParallelization so its global
     env-var mutation cannot bleed into parallel tests (new GlobalEnvironmentCollection).

2. AuthStoreHealthCheckTests opened a real SQLite file; Microsoft.Data.Sqlite's
   connection pool keeps the .db handle open after 'await using', so the finally
   File.Delete threw. Reuse the existing TempDatabaseDirectory helper, which calls
   SqliteConnection.ClearAllPools() before deleting.

Server build clean; affected classes 17/17 on macOS. Windows full-suite verified separately.

src/ZB.MOM.WW.MxGateway.Server/Security/Tls/SelfSignedCertificateProvider.cs

@@ -163,7 +163,15 @@ public sealed class SelfSignedCertificateProvider
             // temp file empty, harden its permissions, and only then write the PFX into
             // the already-protected file. The temp path is in the same directory as the
             // target so the Move is atomic and preserves the hardened DACL/mode.
-            string temp = path + ".tmp";
+            //
+            // The temp name carries a unique suffix rather than a fixed "<path>.tmp": two
+            // processes (or two parallel callers) generating to the same target must not
+            // collide on one temp file. On Windows a fixed name makes the second writer's
+            // File.Create/Move fail with "the process cannot access the file ... because it
+            // is being used by another process"; a unique name lets each generation stage
+            // independently, and the final atomic Move (last-writer-wins) still yields a
+            // valid, equivalent certificate at the shared path.
+            string temp = $"{path}.{Guid.NewGuid():N}.tmp";
             using (File.Create(temp)) { }
             HardenPermissions(temp);
 

src/ZB.MOM.WW.MxGateway.Tests/Diagnostics/AuthStoreHealthCheckTests.cs

@@ -1,6 +1,7 @@
 using Microsoft.Extensions.Diagnostics.HealthChecks;
 using ZB.MOM.WW.Auth.ApiKeys.Sqlite;
 using ZB.MOM.WW.MxGateway.Server.Diagnostics;
+using ZB.MOM.WW.MxGateway.Tests.Security.Authentication;
 
 namespace ZB.MOM.WW.MxGateway.Tests.Diagnostics;
 
@@ -17,14 +18,14 @@ public sealed class AuthStoreHealthCheckTests
     [Fact]
     public async Task Healthy_WhenStoreReachable()
     {
-        var path = Path.Combine(Path.GetTempPath(), $"authcheck-{Guid.NewGuid():N}.db");
-        try
-        {
-            var check = new AuthStoreHealthCheck(FactoryFor(path));
-            var result = await check.CheckHealthAsync(new HealthCheckContext());
-            Assert.Equal(HealthStatus.Healthy, result.Status);
-        }
-        finally { if (File.Exists(path)) File.Delete(path); }
+        // Open a real SQLite file via the health check. TempDatabaseDirectory clears the
+        // Microsoft.Data.Sqlite connection pool on dispose before deleting the file; without
+        // that the pool keeps the .db handle open and the delete throws "used by another
+        // process" on Windows (a latent full-suite flake — the file opens fine on macOS).
+        using TempDatabaseDirectory directory = TempDatabaseDirectory.Create("authcheck");
+        var check = new AuthStoreHealthCheck(FactoryFor(directory.DatabasePath()));
+        var result = await check.CheckHealthAsync(new HealthCheckContext());
+        Assert.Equal(HealthStatus.Healthy, result.Status);
     }
 
     /// <summary>The health check reports unhealthy when the database path cannot be opened.</summary>

src/ZB.MOM.WW.MxGateway.Tests/Gateway/GatewayTlsBootstrapTests.cs

@@ -9,6 +9,10 @@ using ZB.MOM.WW.MxGateway.Server;
 
 namespace ZB.MOM.WW.MxGateway.Tests.Gateway;
 
+// Sets process-global Kestrel/TLS environment variables that GatewayApplication.Build reads;
+// serialized against all other collections so a parallel host-building test cannot inherit them
+// mid-run and race on the generated-certificate file. See GlobalEnvironmentCollection.
+[Collection(TestSupport.GlobalEnvironmentCollection.Name)]
 public sealed class GatewayTlsBootstrapTests
 {
     /// <summary>

src/ZB.MOM.WW.MxGateway.Tests/TestSupport/GlobalEnvironmentCollection.cs

@@ -0,0 +1,18 @@
+namespace ZB.MOM.WW.MxGateway.Tests.TestSupport;
+
+/// <summary>
+/// xUnit collection for tests that mutate <em>process-global</em> state (environment variables
+/// read by <c>GatewayApplication.Build</c>, e.g. <c>Kestrel__Endpoints__…</c> and
+/// <c>MxGateway__Tls__SelfSignedCertPath</c>). <c>DisableParallelization</c> keeps such a test from
+/// running concurrently with any other collection: otherwise a parallel host-building test inherits
+/// the mutated variables mid-run and the two race on the same generated-certificate file (on Windows,
+/// "the process cannot access the file … because it is being used by another process"). Membership is
+/// deliberately narrow — only add classes that set/clear real environment variables, not ones that
+/// pass configuration through <c>Build([...])</c> command-line args.
+/// </summary>
+[CollectionDefinition(Name, DisableParallelization = true)]
+public sealed class GlobalEnvironmentCollection
+{
+    /// <summary>The collection name applied via <c>[Collection(GlobalEnvironmentCollection.Name)]</c>.</summary>
+    public const string Name = "GlobalEnvironmentMutation";
+}

src/ZB.MOM.WW.MxGateway.Tests/TestSupport/TestHostEnvironmentInitializer.cs

@@ -3,7 +3,8 @@ using System.Runtime.CompilerServices;
 namespace ZB.MOM.WW.MxGateway.Tests.TestSupport;
 
 /// <summary>
-/// Defaults the host environment to Development for the whole test assembly.
+/// Defaults the host environment to Development and isolates the test process's on-disk
+/// gateway paths, for the whole test assembly.
 /// </summary>
 /// <remarks>
 /// Many tests build the full gateway host through <c>GatewayApplication.Build</c> against the dev
@@ -15,6 +16,15 @@ namespace ZB.MOM.WW.MxGateway.Tests.TestSupport;
 /// <c>GatewayOptionsValidator</c> with its <c>isProduction</c> constructor (no host environment) and
 /// are unaffected; a test that needs Production can still pass <c>--environment=Production</c>, which
 /// overrides this default.
+/// <para>
+/// The self-signed-cert path is also defaulted to a per-process temp file. Otherwise every
+/// full-host test that triggers HTTPS-cert generation writes the shared
+/// <c>CommonApplicationData/MxGateway/certs/gateway-selfsigned.pfx</c> default — parallel xUnit
+/// test classes then collide on that path's temp file (Windows: "the process cannot access the
+/// file ... because it is being used by another process"), and on a shared CI/dev box the suite
+/// also fights the deployed gateway service for the same file. Pointing at a per-process path
+/// isolates the suite: the first host-building test generates the cert, the rest load it.
+/// </para>
 /// </remarks>
 internal static class TestHostEnvironmentInitializer
 {
@@ -25,5 +35,17 @@ internal static class TestHostEnvironmentInitializer
         {
             Environment.SetEnvironmentVariable("ASPNETCORE_ENVIRONMENT", "Development");
         }
+
+        if (string.IsNullOrEmpty(Environment.GetEnvironmentVariable("MxGateway__Tls__SelfSignedCertPath")))
+        {
+            // ProcessId keeps the path stable within this test process (so a valid cert
+            // generated by the first host-building test is reused by the rest) yet unique
+            // across processes (so concurrent test runs / the deployed service never share it).
+            string certPath = Path.Combine(
+                Path.GetTempPath(),
+                $"mxgw-tests-{Environment.ProcessId}",
+                "gateway-selfsigned.pfx");
+            Environment.SetEnvironmentVariable("MxGateway__Tls__SelfSignedCertPath", certPath);
+        }
     }
 }