fix(archreview): gateway core P0 remediation (GWC-01/02/03, TST-02, TST-12)

Interlocking changes across the gateway server (shared GatewaySession.cs /
SessionManager.cs), committed together:

- GWC-01 (Critical): alarm monitor now attaches as an internal
  (non-counted) distributor subscriber instead of a second raw drain of the
  single worker event channel; WorkerClient._events -> SingleReader with a
  claimed-once guard so a future dual-consumer regression throws loudly.
- GWC-02 (High): faulted sessions are swept in CloseExpiredLeasesAsync
  (IsFaultedReapable + FaultedReason); new FaultedGraceSeconds (default 0).
- GWC-03 (High): configurable MaxSparseArrayLength (default 1_000_000)
  enforced before allocation.
- TST-02 (High, security): StreamEvents attach now enforces the opening key
  id -> PermissionDenied on owner mismatch.
- TST-12 (Medium): CLAUDE.md retention-defaults sentence corrected.

Verified: NonWindows build clean; targeted tests 135/135 on macOS, plus
WorkerClientTests 18/18 on the Windows host.

src/ZB.MOM.WW.MxGateway.Server/Sessions/ISessionManager.cs

@@ -43,6 +43,18 @@ public interface ISessionManager
         string sessionId,
         CancellationToken cancellationToken);
 
+    /// <summary>
+    ///     Reads mapped events for the central alarm monitor by attaching an internal
+    ///     (non-counted) distributor subscriber, so the alarm feed shares the one worker-event
+    ///     pump instead of opening a second raw drain of the single worker event channel.
+    /// </summary>
+    /// <param name="sessionId">Identifier of the session.</param>
+    /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
+    /// <returns>The mapped <see cref="MxEvent"/>s fanned by the session's distributor.</returns>
+    IAsyncEnumerable<MxEvent> ReadAlarmEventsAsync(
+        string sessionId,
+        CancellationToken cancellationToken);
+
     /// <summary>Closes a session and terminates its worker process.</summary>
     /// <param name="sessionId">Identifier of the session to close.</param>
     /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>