fix(archreview): gateway core P0 remediation (GWC-01/02/03, TST-02, TST-12)

Interlocking changes across the gateway server (shared GatewaySession.cs /
SessionManager.cs), committed together:

- GWC-01 (Critical): alarm monitor now attaches as an internal
  (non-counted) distributor subscriber instead of a second raw drain of the
  single worker event channel; WorkerClient._events -> SingleReader with a
  claimed-once guard so a future dual-consumer regression throws loudly.
- GWC-02 (High): faulted sessions are swept in CloseExpiredLeasesAsync
  (IsFaultedReapable + FaultedReason); new FaultedGraceSeconds (default 0).
- GWC-03 (High): configurable MaxSparseArrayLength (default 1_000_000)
  enforced before allocation.
- TST-02 (High, security): StreamEvents attach now enforces the opening key
  id -> PermissionDenied on owner mismatch.
- TST-12 (Medium): CLAUDE.md retention-defaults sentence corrected.

Verified: NonWindows build clean; targeted tests 135/135 on macOS, plus
WorkerClientTests 18/18 on the Windows host.

src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs

@@ -225,11 +225,14 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
             Task reconcileLoop = ReconcileLoopAsync(session.SessionId, linked.Token);
             try
             {
-                await foreach (WorkerEvent workerEvent in _sessionManager
-                    .ReadEventsAsync(session.SessionId, linked.Token)
+                // Consume mapped MxEvents through the session's single distributor pump (as an
+                // internal, non-counted subscriber) rather than opening a second raw drain of the
+                // worker event channel — a second drain would split events with the dashboard
+                // mirror pump and silently lose Acknowledge/mode-change transitions (GWC-01).
+                await foreach (MxEvent mxEvent in _sessionManager
+                    .ReadAlarmEventsAsync(session.SessionId, linked.Token)
                     .ConfigureAwait(false))
                 {
-                    MxEvent? mxEvent = workerEvent.Event;
                     if (mxEvent is { BodyCase: MxEvent.BodyOneofCase.OnAlarmTransition }
                         && mxEvent.OnAlarmTransition is not null)
                     {