feat(alarms): structural degraded-status signal for truncated alarm snapshots

The truncation-cliff fix made alarm transitions truncation-safe but silent:
when GetXmlCurrentAlarms2 returns exactly maxAlmCnt records the worker
suppresses absence-implies-Clear inference and says so only in a rate-limited
stderr warning. No client and no operator could tell a complete active set
from a capped one.

Two additive proto3 booleans carry the verdict out:

- QueryActiveAlarmsReplyPayload.snapshot_truncated = 2 (worker IPC reply)
- ActiveAlarmSnapshot.from_truncated_snapshot = 16 (per record)

The per-record field is not an aesthetic choice. QueryActiveAlarms returns a
bare `stream ActiveAlarmSnapshot` with no envelope, header, or trailer, so a
per-record boolean is the only carrier that stays wire-compatible; an envelope
message would change every existing client's stream element type. The reply
payload states it too because a prefix filter can leave zero records and a
truncated fetch with nothing to report still has to say so. The flag means
"this set may be incomplete", never "this record is unreliable" — it is
independent of the subtag-fallback `degraded` field.

Detection is deliberately UNCHANGED: IsTruncatedFetch remains
`fetchedRecordCount >= maxAlarmsPerFetch`. The live probe (docs/AlarmProbeFindings.md,
ce5d8ae) could not verify whether ALARM_RECORDS/@COUNT reports the total active
count or only the records in the reply, so @COUNT is not parsed for detection;
switching to it stays blocked on probe evidence. The probe's comment
annotations in WnWrapAlarmConsumer.cs are preserved.

Reset semantics: not latched. WnWrapAlarmConsumer.FoldFetch replaces the
verdict on every poll under the same lock as the snapshot merge, so the first
sub-cap fetch clears it; GatewayAlarmMonitor.ClearCache drops it with the cache
generation it describes. A caveat that never turns off is one operators learn
to ignore.

Flow: WnWrapAlarmConsumer.LastSnapshotTruncated -> AlarmDispatcher (stamps every
record) / IAlarmCommandHandler (payload) -> MxAccessCommandExecutor reply ->
GatewayAlarmMonitor._snapshotTruncated -> IGatewayAlarmService.SnapshotTruncated
-> DashboardAlarmQueryResult -> AlarmsPage warning banner (render-side only; the
poll loop and DisposeAsync drain are untouched). The public QueryActiveAlarms
RPC forwards worker snapshots unmodified, so the per-record flag needed no
mapper change — a test pins that.

Parity: this describes OUR fetch mechanics — additive gateway metadata — not
MXAccess provider behavior. No event is synthesized and no MXAccess-observable
semantics change, so it is not a parity deviation.

Tests: worker LastSnapshotTruncated set/reset/consecutive-burst (windev-run);
gateway end-to-end truncated reply -> monitor -> public stream, with the
complete-reply control as the load-bearing assertion; AlarmsPage banner
present/absent. Docs: gateway.md alarm surface, docs/DesignDecisions.md entry.

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs

@@ -158,16 +158,28 @@ public sealed class AlarmDispatcher : IDisposable
     public IReadOnlyList<ActiveAlarmSnapshot> SnapshotActiveAlarms()
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
+        // Read the truncation verdict before the snapshot, so a poll landing
+        // between the two can only widen the warning (a stale "truncated" over a
+        // complete snapshot), never narrow it into a false all-clear.
+        bool truncated = consumer.LastSnapshotTruncated;
         IReadOnlyList<MxAlarmSnapshotRecord> records = consumer.SnapshotActiveAlarms();
         if (records.Count == 0) return Array.Empty<ActiveAlarmSnapshot>();
         List<ActiveAlarmSnapshot> snapshots = new List<ActiveAlarmSnapshot>(records.Count);
         foreach (MxAlarmSnapshotRecord record in records)
         {
-            snapshots.Add(MapToSnapshot(record));
+            snapshots.Add(MapToSnapshot(record, truncated));
         }
         return snapshots;
     }
 
+    /// <summary>
+    ///     Whether the consumer's most recent fetch hit the per-fetch cap, so
+    ///     the set <see cref="SnapshotActiveAlarms"/> returns may omit actives.
+    ///     Stamped onto the QueryActiveAlarms reply payload, which is the only
+    ///     carrier when the snapshot filters down to zero records.
+    /// </summary>
+    public bool LastSnapshotTruncated => !disposed && consumer.LastSnapshotTruncated;
+
     private void OnTransition(object? sender, MxAlarmTransitionEvent transition)
     {
         if (disposed) return;
@@ -196,7 +208,7 @@ public sealed class AlarmDispatcher : IDisposable
             degraded: record.Degraded);
     }
 
-    private static ActiveAlarmSnapshot MapToSnapshot(MxAlarmSnapshotRecord record)
+    private static ActiveAlarmSnapshot MapToSnapshot(MxAlarmSnapshotRecord record, bool truncated)
     {
         ActiveAlarmSnapshot snapshot = new ActiveAlarmSnapshot
         {
@@ -212,6 +224,12 @@ public sealed class AlarmDispatcher : IDisposable
             Description = string.Empty,
             Degraded = record.Degraded,
             SourceProvider = record.Degraded ? AlarmProviderMode.Subtag : AlarmProviderMode.Alarmmgr,
+            // Set-level status, stamped identically on every record of the
+            // snapshot: QueryActiveAlarms streams bare ActiveAlarmSnapshot
+            // messages with no envelope to hang it off. Independent of
+            // Degraded above — that is about this record's provider, this is
+            // about whether the set it belongs to is complete.
+            FromTruncatedSnapshot = truncated,
         };
         if (record.TransitionTimestampUtc != DateTime.MinValue)
         {