feat(alarms): structural degraded-status signal for truncated alarm snapshots

The truncation-cliff fix made alarm transitions truncation-safe but silent:
when GetXmlCurrentAlarms2 returns exactly maxAlmCnt records the worker
suppresses absence-implies-Clear inference and says so only in a rate-limited
stderr warning. No client and no operator could tell a complete active set
from a capped one.

Two additive proto3 booleans carry the verdict out:

- QueryActiveAlarmsReplyPayload.snapshot_truncated = 2 (worker IPC reply)
- ActiveAlarmSnapshot.from_truncated_snapshot = 16 (per record)

The per-record field is not an aesthetic choice. QueryActiveAlarms returns a
bare `stream ActiveAlarmSnapshot` with no envelope, header, or trailer, so a
per-record boolean is the only carrier that stays wire-compatible; an envelope
message would change every existing client's stream element type. The reply
payload states it too because a prefix filter can leave zero records and a
truncated fetch with nothing to report still has to say so. The flag means
"this set may be incomplete", never "this record is unreliable" — it is
independent of the subtag-fallback `degraded` field.

Detection is deliberately UNCHANGED: IsTruncatedFetch remains
`fetchedRecordCount >= maxAlarmsPerFetch`. The live probe (docs/AlarmProbeFindings.md,
ce5d8ae) could not verify whether ALARM_RECORDS/@COUNT reports the total active
count or only the records in the reply, so @COUNT is not parsed for detection;
switching to it stays blocked on probe evidence. The probe's comment
annotations in WnWrapAlarmConsumer.cs are preserved.

Reset semantics: not latched. WnWrapAlarmConsumer.FoldFetch replaces the
verdict on every poll under the same lock as the snapshot merge, so the first
sub-cap fetch clears it; GatewayAlarmMonitor.ClearCache drops it with the cache
generation it describes. A caveat that never turns off is one operators learn
to ignore.

Flow: WnWrapAlarmConsumer.LastSnapshotTruncated -> AlarmDispatcher (stamps every
record) / IAlarmCommandHandler (payload) -> MxAccessCommandExecutor reply ->
GatewayAlarmMonitor._snapshotTruncated -> IGatewayAlarmService.SnapshotTruncated
-> DashboardAlarmQueryResult -> AlarmsPage warning banner (render-side only; the
poll loop and DisposeAsync drain are untouched). The public QueryActiveAlarms
RPC forwards worker snapshots unmodified, so the per-record flag needed no
mapper change — a test pins that.

Parity: this describes OUR fetch mechanics — additive gateway metadata — not
MXAccess provider behavior. No event is synthesized and no MXAccess-observable
semantics change, so it is not a parity deviation.

Tests: worker LastSnapshotTruncated set/reset/consecutive-burst (windev-run);
gateway end-to-end truncated reply -> monitor -> public stream, with the
complete-reply control as the load-bearing assertion; AlarmsPage banner
present/absent. Docs: gateway.md alarm surface, docs/DesignDecisions.md entry.

src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs

@@ -57,6 +57,11 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
     private string _providerReason = string.Empty;
     private DateTimeOffset _providerSince = DateTimeOffset.UtcNow;
 
+    // Whether the worker's most recent reconcile fetch was capped, guarded by _sync.
+    // Written only by ApplyReconcile, so it always describes the same pass that
+    // produced the current _alarms generation.
+    private bool _snapshotTruncated;
+
     private volatile GatewayAlarmMonitorState _state = GatewayAlarmMonitorState.Disabled;
     private volatile string? _lastError;
     private GatewaySession? _session;
@@ -110,6 +115,12 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         }
     }
 
+    /// <inheritdoc />
+    public bool SnapshotTruncated
+    {
+        get { lock (_sync) { return _snapshotTruncated; } }
+    }
+
     /// <inheritdoc />
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
@@ -416,7 +427,7 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         QueryActiveAlarmsReplyPayload? payload = reply.Reply.QueryActiveAlarms;
         if (payload is not null)
         {
-            ApplyReconcile(payload.Snapshots);
+            ApplyReconcile(payload.Snapshots, payload.SnapshotTruncated);
         }
     }
 
@@ -610,7 +621,13 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
     // suppressed. The dedup fires only on a positive marker match, so the contract stays
     // at-least-once: consumers must still treat alarm state idempotently — apply a transition as
     // "set the alarm to this state", never as an increment or a toggle.
-    private void ApplyReconcile(IEnumerable<ActiveAlarmSnapshot> snapshots)
+    //
+    // Truncation (`snapshotTruncated`) needs no special handling here, and that is worth saying
+    // because the obvious worry — a capped fetch reading as a wave of Clears — is answered one
+    // level down. The worker merges rather than replaces its retained snapshot on a capped fetch,
+    // so the set arriving here still carries the alarms the capped reply had no room to mention.
+    // The flag is therefore only recorded, for the operator-facing completeness caveat.
+    private void ApplyReconcile(IEnumerable<ActiveAlarmSnapshot> snapshots, bool snapshotTruncated)
     {
         Dictionary<string, ActiveAlarmSnapshot> next = new(StringComparer.Ordinal);
         foreach (ActiveAlarmSnapshot snapshot in snapshots)
@@ -669,6 +686,7 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
                 _alarms[incoming.Key] = incoming.Value;
             }
 
+            _snapshotTruncated = snapshotTruncated;
             _currentAlarmsProjection = null;
         }
     }
@@ -716,6 +734,10 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         lock (_sync)
         {
             _alarms.Clear();
+            // The truncation verdict describes the cache generation being discarded, so it goes
+            // with it. Carrying it across a monitor restart would caveat an empty set as "may be
+            // incomplete" on evidence from a session that no longer exists.
+            _snapshotTruncated = false;
             _currentAlarmsProjection = null;
         }
     }