Merge branch 'fix/archreview-p2' into main (P2 tier: completeness & polish)

# Conflicts:
#	archreview/remediation/00-tracking.md
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayCliSecretRedactor.cs
#	clients/dotnet/ZB.MOM.WW.MxGateway.Client.Cli/MxGatewayClientCli.cs
#	src/ZB.MOM.WW.MxGateway.Worker.Tests/Ipc/WorkerFrameProtocolTests.cs

src/ZB.MOM.WW.MxGateway.Server/Workers/WorkerClient.cs

@@ -997,9 +997,14 @@ public sealed class WorkerClient : IWorkerClient
         string correlationId,
         WorkerCommand command)
     {
+        // IPC-05: no second clone. MxAccessGrpcMapper.MapCommand already deep-cloned the command
+        // out of the caller-owned gRPC MxCommandRequest, so this WorkerCommand is a fresh graph
+        // owned by the invoke pipeline and referenced by no other consumer. The envelope is built
+        // and owned entirely inside WorkerClient and the command is not touched again after this
+        // point, so transferring it into the envelope introduces no aliasing hazard.
         return CreateEnvelope(
             correlationId,
-            envelope => envelope.WorkerCommand = command.Clone());
+            envelope => envelope.WorkerCommand = command);
     }
 
     /// <summary>Creates shutdown envelope.</summary>