fix(WRK-22,WRK-24,WRK-25,WRK-27,IPC-26): worker write-seam hardening

WRK-22/IPC-26: tombstone a WriteAsync/WriteBatchAsync cancelled while
waiting for the write lock (PendingFrame.Claimed under _gate; DequeueNext
skips cancelled, claims the frame it returns) so a cancelled write never
reaches the wire unless already claimed mid-write (documented residual).

WRK-25: add WriteBatchAsync; RunEventDrainLoopAsync submits the drained
event batch through it, so a burst of N events costs one flush not N.
IPC-30 oversized-event structured fault preserved via FindOversizedEvent.

WRK-24: reject a below-1024 negotiated frame maximum at the handshake
(MinNegotiableFrameBytes, matching GatewayOptionsValidator floor).

WRK-27: alarm poll advertises StaCallInProgress on the heartbeat snapshot
so the watchdog suppresses to the ceiling, not the grace.

Docs (WorkerFrameProtocol.md, MxAccessWorkerInstanceDesign.md) and the
2026-07-12 remediation registers/change-log updated in the same commit.

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WorkerRuntimeHeartbeatSnapshot.cs

@@ -10,18 +10,26 @@ public sealed class WorkerRuntimeHeartbeatSnapshot
     /// <param name="outboundEventQueueDepth">Current depth of the worker event queue.</param>
     /// <param name="lastEventSequence">Sequence number of the most recent event.</param>
     /// <param name="currentCommandCorrelationId">Correlation ID of the in-flight command.</param>
+    /// <param name="staCallInProgress">
+    /// True while an STA call outside the command dispatcher is executing (currently the alarm poll,
+    /// WRK-27). The watchdog treats this like an in-flight command: it suppresses the stale-STA fault
+    /// up to the stuck ceiling instead of the shorter grace, so a healthy-but-slow poll does not fault
+    /// a healthy session. Named generically so any future non-dispatcher STA work reuses it.
+    /// </param>
     public WorkerRuntimeHeartbeatSnapshot(
         DateTimeOffset lastStaActivityUtc,
         uint pendingCommandCount,
         uint outboundEventQueueDepth,
         ulong lastEventSequence,
-        string currentCommandCorrelationId)
+        string currentCommandCorrelationId,
+        bool staCallInProgress = false)
     {
         LastStaActivityUtc = lastStaActivityUtc;
         PendingCommandCount = pendingCommandCount;
         OutboundEventQueueDepth = outboundEventQueueDepth;
         LastEventSequence = lastEventSequence;
         CurrentCommandCorrelationId = currentCommandCorrelationId ?? string.Empty;
+        StaCallInProgress = staCallInProgress;
     }
 
     /// <summary>Gets the last STA activity timestamp in UTC.</summary>
@@ -38,4 +46,11 @@ public sealed class WorkerRuntimeHeartbeatSnapshot
 
     /// <summary>Gets the correlation ID of the in-flight command.</summary>
     public string CurrentCommandCorrelationId { get; }
+
+    /// <summary>
+    /// Gets a value indicating whether an STA call outside the command dispatcher (the alarm poll) is
+    /// executing. When true the watchdog grants the poll the same grace-to-ceiling suppression as a
+    /// dispatched command (WRK-27).
+    /// </summary>
+    public bool StaCallInProgress { get; }
 }