fix(archreview): gateway core P0 remediation (GWC-01/02/03, TST-02, TST-12)

Interlocking changes across the gateway server (shared GatewaySession.cs /
SessionManager.cs), committed together:

- GWC-01 (Critical): alarm monitor now attaches as an internal
  (non-counted) distributor subscriber instead of a second raw drain of the
  single worker event channel; WorkerClient._events -> SingleReader with a
  claimed-once guard so a future dual-consumer regression throws loudly.
- GWC-02 (High): faulted sessions are swept in CloseExpiredLeasesAsync
  (IsFaultedReapable + FaultedReason); new FaultedGraceSeconds (default 0).
- GWC-03 (High): configurable MaxSparseArrayLength (default 1_000_000)
  enforced before allocation.
- TST-02 (High, security): StreamEvents attach now enforces the opening key
  id -> PermissionDenied on owner mismatch.
- TST-12 (Medium): CLAUDE.md retention-defaults sentence corrected.

Verified: NonWindows build clean; targeted tests 135/135 on macOS, plus
WorkerClientTests 18/18 on the Windows host.

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerTests.cs

@@ -975,6 +975,68 @@ public sealed class SessionManagerTests
         Assert.Equal(0, workerClient.ShutdownCount);
     }
 
+    /// <summary>
+    ///     A faulted session is reaped by the lease sweep (default <c>FaultedGraceSeconds=0</c>)
+    ///     even though its normal lease is still far in the future, tearing down its worker and
+    ///     freeing the slot, while a healthy leased session in the same manager is untouched.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task CloseExpiredLeasesAsync_ReapsFaultedSession()
+    {
+        FakeWorkerClient faultedClient = new();
+        FakeWorkerClient healthyClient = new();
+        QueueingSessionWorkerClientFactory factory = new(faultedClient, healthyClient);
+        SessionManager manager = CreateManager(factory);
+        GatewaySession faultedSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
+        GatewaySession healthySession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-2", ownerKeyId: null, CancellationToken.None);
+        DateTimeOffset now = DateTimeOffset.UtcNow;
+
+        // Both leases are far in the future, so only the fault can reap the faulted session.
+        faultedSession.ExtendLease(now.AddMinutes(30));
+        healthySession.ExtendLease(now.AddMinutes(30));
+        faultedSession.MarkFaulted("test fault");
+
+        int closedCount = await manager.CloseExpiredLeasesAsync(now, CancellationToken.None);
+
+        Assert.Equal(1, closedCount);
+        Assert.Equal(SessionState.Closed, faultedSession.State);
+        Assert.Equal(1, faultedClient.ShutdownCount);
+        Assert.Equal(SessionState.Ready, healthySession.State);
+        Assert.Equal(0, healthyClient.ShutdownCount);
+    }
+
+    /// <summary>
+    ///     With a positive <c>FaultedGraceSeconds</c>, a faulted session stays observable until
+    ///     the grace window elapses, then the next sweep reaps it.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task CloseExpiredLeasesAsync_RespectsFaultedGraceWindow()
+    {
+        FakeWorkerClient workerClient = new();
+        FakeTimeProvider clock = new(DateTimeOffset.UtcNow);
+        SessionManager manager = CreateManager(
+            new FakeSessionWorkerClientFactory(workerClient),
+            options: CreateOptions(defaultLeaseSeconds: 1800, faultedGraceSeconds: 30),
+            timeProvider: clock);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
+        session.MarkFaulted("test fault");
+
+        // Before the grace window elapses: the faulted session is retained (still observable).
+        clock.Advance(TimeSpan.FromSeconds(29));
+        int closedBefore = await manager.CloseExpiredLeasesAsync(clock.GetUtcNow(), CancellationToken.None);
+        Assert.Equal(0, closedBefore);
+        Assert.Equal(SessionState.Faulted, session.State);
+
+        // After the grace window elapses: the sweep reaps it.
+        clock.Advance(TimeSpan.FromSeconds(1));
+        int closedAfter = await manager.CloseExpiredLeasesAsync(clock.GetUtcNow(), CancellationToken.None);
+        Assert.Equal(1, closedAfter);
+        Assert.Equal(SessionState.Closed, session.State);
+        Assert.Equal(1, workerClient.ShutdownCount);
+    }
+
     /// <summary>Verifies that shutdown closes all registered sessions.</summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
@@ -1023,7 +1085,8 @@ public sealed class SessionManagerTests
         int maxSessions = 64,
         int defaultLeaseSeconds = 1800,
         int detachGraceSeconds = 0,
-        int workerReadyWaitTimeoutMs = 0)
+        int workerReadyWaitTimeoutMs = 0,
+        int faultedGraceSeconds = 0)
     {
         return new GatewayOptions
         {
@@ -1034,6 +1097,7 @@ public sealed class SessionManagerTests
                 DefaultLeaseSeconds = defaultLeaseSeconds,
                 DetachGraceSeconds = detachGraceSeconds,
                 WorkerReadyWaitTimeoutMs = workerReadyWaitTimeoutMs,
+                FaultedGraceSeconds = faultedGraceSeconds,
             },
             Worker = new WorkerOptions
             {