fix(archreview): gateway core P0 remediation (GWC-01/02/03, TST-02, TST-12)

Interlocking changes across the gateway server (shared GatewaySession.cs /
SessionManager.cs), committed together:

- GWC-01 (Critical): alarm monitor now attaches as an internal
  (non-counted) distributor subscriber instead of a second raw drain of the
  single worker event channel; WorkerClient._events -> SingleReader with a
  claimed-once guard so a future dual-consumer regression throws loudly.
- GWC-02 (High): faulted sessions are swept in CloseExpiredLeasesAsync
  (IsFaultedReapable + FaultedReason); new FaultedGraceSeconds (default 0).
- GWC-03 (High): configurable MaxSparseArrayLength (default 1_000_000)
  enforced before allocation.
- TST-02 (High, security): StreamEvents attach now enforces the opening key
  id -> PermissionDenied on owner mismatch.
- TST-12 (Medium): CLAUDE.md retention-defaults sentence corrected.

Verified: NonWindows build clean; targeted tests 135/135 on macOS, plus
WorkerClientTests 18/18 on the Windows host.

src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs

@@ -1,4 +1,5 @@
 using System.Diagnostics.CodeAnalysis;
+using System.Runtime.CompilerServices;
 using System.Security.Cryptography;
 using Google.Protobuf.WellKnownTypes;
 using Microsoft.Extensions.Logging;
@@ -18,6 +19,7 @@ public sealed class SessionManager : ISessionManager
     public const string GatewayShutdownReason = "gateway-shutdown";
     public const string LeaseExpiredReason = "lease-expired";
     public const string DetachGraceExpiredReason = "detach-grace-expired";
+    public const string FaultedReason = "faulted-reaped";
 
     private readonly ISessionRegistry _registry;
     private readonly ISessionWorkerClientFactory _workerClientFactory;
@@ -189,6 +191,22 @@ public sealed class SessionManager : ISessionManager
         return session.ReadEventsAsync(cancellationToken);
     }
 
+    /// <inheritdoc />
+    public async IAsyncEnumerable<MxEvent> ReadAlarmEventsAsync(
+        string sessionId,
+        [EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        GatewaySession session = GetRequiredSession(sessionId);
+        using IEventSubscriberLease lease = session.AttachInternalEventSubscriber();
+
+        await foreach (MxEvent mxEvent in lease.Reader
+            .ReadAllAsync(cancellationToken)
+            .ConfigureAwait(false))
+        {
+            yield return mxEvent;
+        }
+    }
+
     /// <inheritdoc />
     public async Task<SessionCloseResult> CloseSessionAsync(
         string sessionId,
@@ -259,22 +277,25 @@ public sealed class SessionManager : ISessionManager
         int closedCount = 0;
         foreach (GatewaySession session in _registry.Snapshot())
         {
-            // A session is swept when its normal lease has expired OR its detach-grace
-            // retention window has elapsed (last external subscriber dropped and no client
-            // reconnected within DetachGraceSeconds). The detach-grace close is the same
-            // teardown as a lease-expiry close; only the reason differs so operators can tell
-            // a short reconnect-window expiry from a long idle-lease expiry in logs/metrics.
-            // Lease-expiry takes PRECEDENCE over detach-grace when both conditions fire
-            // simultaneously (reason will be lease-expired, not detach-grace-expired).
+            // A session is swept when its normal lease has expired, it has FAULTED (a faulted
+            // session is permanently unusable yet otherwise pins a session slot and a live x86
+            // worker until its DefaultLeaseSeconds lease expires), OR its detach-grace retention
+            // window has elapsed (last external subscriber dropped and no client reconnected
+            // within DetachGraceSeconds). All three are the same teardown; only the reason differs
+            // so operators can tell a fault reap from a short reconnect-window expiry from a long
+            // idle-lease expiry in logs/metrics. Precedence when several fire simultaneously:
+            // lease-expired, then faulted, then detach-grace.
             //
             // TOCTOU note: eligibility is re-verified atomically inside TryBeginCloseIfExpired
             // under _syncRoot, so a client that reattaches a subscriber between the check above
             // and the close call wins the race and the session is left open and usable.
             string? reason = session.IsLeaseExpired(now)
                 ? LeaseExpiredReason
-                : session.IsDetachGraceExpired(now)
-                    ? DetachGraceExpiredReason
-                    : null;
+                : session.IsFaultedReapable(now)
+                    ? FaultedReason
+                    : session.IsDetachGraceExpired(now)
+                        ? DetachGraceExpiredReason
+                        : null;
             if (reason is null)
             {
                 continue;
@@ -457,7 +478,8 @@ public sealed class SessionManager : ISessionManager
             eventStreaming,
             TimeSpan.FromSeconds(Math.Max(0, _options.Sessions.DetachGraceSeconds)),
             TimeSpan.FromMilliseconds(Math.Max(0, _options.Sessions.WorkerReadyWaitTimeoutMs)),
-            _addressNormalizer);
+            _addressNormalizer,
+            TimeSpan.FromSeconds(Math.Max(0, _options.Sessions.FaultedGraceSeconds)));
     }
 
     private static string CreateClientCorrelationId(