feat(sitecall-audit): carry + persist SourceNode end-to-end via cached telemetry

Site: site emitters of SiteCallOperational (ExternalSystemClient, the script-API
cached call path in ScriptRuntimeContext, CachedCallLifecycleBridge) inject
INodeIdentityProvider and stamp SourceNode = NodeName at construction.

OperationTrackingStore call site in CachedCallTelemetryForwarder now stamps
SourceNode too.

Central: SiteCallAuditRepository.UpsertAsync INSERT includes SourceNode in the
column list; conditional monotonic UPDATE uses
COALESCE(@SourceNode, SourceNode) so later packets cannot blank a previously-
stamped value. After this commit every SiteCalls row carries node-a/node-b in
SourceNode (subject to monotonic preservation).

tests/ScadaLink.AuditLog.Tests/Site/Telemetry/CachedCallLifecycleBridgeTests.cs

@@ -327,4 +327,68 @@ public class CachedCallLifecycleBridgeTests
         Assert.NotNull(captured);
         Assert.Null(captured!.Audit.ParentExecutionId);
     }
+
+    // ── SourceNode-stamping (Task 14) ──
+
+    [Fact]
+    public async Task RetryLoopRow_StampsSourceNode_FromNodeIdentityProvider()
+    {
+        // SourceNode-stamping (Task 14): when an INodeIdentityProvider is
+        // wired the bridge stamps the local node name (node-a/node-b) onto
+        // the SiteCallOperational.SourceNode column of every emitted packet.
+        var nodeIdentity = Substitute.For<INodeIdentityProvider>();
+        nodeIdentity.NodeName.Returns("node-a");
+
+        var captured = new List<CachedCallTelemetry>();
+        _forwarder.ForwardAsync(Arg.Do<CachedCallTelemetry>(t => captured.Add(t)), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var sut = new CachedCallLifecycleBridge(
+            _forwarder, NullLogger<CachedCallLifecycleBridge>.Instance, nodeIdentity);
+
+        await sut.OnAttemptCompletedAsync(Ctx(CachedCallAttemptOutcome.Delivered));
+
+        Assert.Equal(2, captured.Count);
+        Assert.All(captured, p => Assert.Equal("node-a", p.Operational.SourceNode));
+    }
+
+    [Fact]
+    public async Task RetryLoopRow_NoNodeIdentityProvider_LeavesSourceNodeNull()
+    {
+        // When no INodeIdentityProvider is wired (legacy hosts / tests) the
+        // bridge degrades to a null SourceNode rather than throwing. The
+        // emitted packet's SourceNode is null so the central row persists NULL.
+        var captured = new List<CachedCallTelemetry>();
+        _forwarder.ForwardAsync(Arg.Do<CachedCallTelemetry>(t => captured.Add(t)), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        // Default CreateSut() does NOT pass a node-identity provider.
+        var sut = CreateSut();
+        await sut.OnAttemptCompletedAsync(Ctx(CachedCallAttemptOutcome.TransientFailure));
+
+        var packet = Assert.Single(captured);
+        Assert.Null(packet.Operational.SourceNode);
+    }
+
+    [Fact]
+    public async Task RetryLoopRow_NodeIdentityWithNullNodeName_LeavesSourceNodeNull()
+    {
+        // The provider exists but reports a null NodeName (unconfigured). The
+        // bridge must pass that null through to SourceNode rather than
+        // falling back to a placeholder.
+        var nodeIdentity = Substitute.For<INodeIdentityProvider>();
+        nodeIdentity.NodeName.Returns((string?)null);
+
+        var captured = new List<CachedCallTelemetry>();
+        _forwarder.ForwardAsync(Arg.Do<CachedCallTelemetry>(t => captured.Add(t)), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var sut = new CachedCallLifecycleBridge(
+            _forwarder, NullLogger<CachedCallLifecycleBridge>.Instance, nodeIdentity);
+
+        await sut.OnAttemptCompletedAsync(Ctx(CachedCallAttemptOutcome.TransientFailure));
+
+        var packet = Assert.Single(captured);
+        Assert.Null(packet.Operational.SourceNode);
+    }
 }