feat(auditlog): thread ExecutionId through S&F for retry-loop cached rows

The store-and-forward retry loop emits the per-attempt and terminal cached
audit rows (ApiCallCached/DbWriteCached Attempted, CachedResolve) via
CachedCallLifecycleBridge from a CachedCallAttemptContext, not from the
script context. ExecutionId (and SourceScript) were not threaded through the
S&F buffer, so those rows had ExecutionId = null and SourceScript = null.

Thread both, additively, from the cached-call enqueue path:

- StoreAndForwardMessage gains ExecutionId (Guid?) / SourceScript (string?).
- StoreAndForwardStorage adds nullable execution_id / source_script columns
  via an idempotent PRAGMA-probed ALTER TABLE migration; rows persisted by
  an older build read back null (back-compat).
- StoreAndForwardService.EnqueueAsync gains optional executionId /
  sourceScript params, stamped onto the buffered message and surfaced on the
  CachedCallAttemptContext built in the retry loop.
- CachedCallAttemptContext gains ExecutionId / SourceScript.
- CachedCallLifecycleBridge.BuildPacket sets AuditEvent.ExecutionId and
  AuditEvent.SourceScript from the context (replacing the hard-coded
  SourceScript = null and its now-stale comment).
- IExternalSystemClient.CachedCallAsync / IDatabaseGateway.CachedWriteAsync
  gain optional executionId / sourceScript params; ScriptRuntimeContext's
  CachedCall / CachedWrite helpers pass _executionId / _sourceScript.

Script-side cached rows (CachedSubmit, immediate Attempted+Resolve) are
unchanged. All threading is additive — old buffered S&F rows still
deserialize and process with the new fields null.

tests/ScadaLink.AuditLog.Tests/Site/Telemetry/CachedCallLifecycleBridgeTests.cs

@@ -31,7 +31,9 @@ public class CachedCallLifecycleBridgeTests
         string channel = "ApiOutbound",
         int retryCount = 1,
         string? lastError = null,
-        int? httpStatus = null) =>
+        int? httpStatus = null,
+        Guid? executionId = null,
+        string? sourceScript = null) =>
         new(
             TrackedOperationId: _id,
             Channel: channel,
@@ -44,7 +46,9 @@ public class CachedCallLifecycleBridgeTests
             CreatedAtUtc: new DateTime(2026, 5, 20, 9, 0, 0, DateTimeKind.Utc),
             OccurredAtUtc: new DateTime(2026, 5, 20, 10, 0, 0, DateTimeKind.Utc),
             DurationMs: 42,
-            SourceInstanceId: "Plant.Pump42");
+            SourceInstanceId: "Plant.Pump42",
+            ExecutionId: executionId,
+            SourceScript: sourceScript);
 
     [Fact]
     public async Task TransientFailure_EmitsOneAttemptedRow_NoResolve()
@@ -184,4 +188,75 @@ public class CachedCallLifecycleBridgeTests
         Assert.Equal(42, captured.Audit.DurationMs);
         Assert.Equal(_id.Value, captured.Audit.CorrelationId);
     }
+
+    // ── Audit Log #23 (ExecutionId Task 4): ExecutionId / SourceScript ──
+
+    [Fact]
+    public async Task RetryLoopAttemptedRow_CarriesExecutionIdAndSourceScript_FromContext()
+    {
+        // Task 4: the ExecutionId + SourceScript threaded through the S&F
+        // buffer arrive on the CachedCallAttemptContext; the bridge must stamp
+        // both onto the per-attempt ApiCallCached row (previously SourceScript
+        // was hard-coded null with a "not threaded through S&F" comment).
+        var executionId = Guid.NewGuid();
+        var captured = new List<CachedCallTelemetry>();
+        _forwarder.ForwardAsync(Arg.Do<CachedCallTelemetry>(t => captured.Add(t)), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var sut = CreateSut();
+        await sut.OnAttemptCompletedAsync(Ctx(
+            CachedCallAttemptOutcome.TransientFailure,
+            executionId: executionId,
+            sourceScript: "Plant.Pump42/OnTick"));
+
+        var packet = Assert.Single(captured);
+        Assert.Equal(AuditKind.ApiCallCached, packet.Audit.Kind);
+        Assert.Equal(executionId, packet.Audit.ExecutionId);
+        Assert.Equal("Plant.Pump42/OnTick", packet.Audit.SourceScript);
+    }
+
+    [Fact]
+    public async Task RetryLoopCachedResolveRow_CarriesExecutionIdAndSourceScript_FromContext()
+    {
+        // The terminal CachedResolve row must also carry the threaded
+        // provenance so the whole retry-loop lifecycle is correlated.
+        var executionId = Guid.NewGuid();
+        var captured = new List<CachedCallTelemetry>();
+        _forwarder.ForwardAsync(Arg.Do<CachedCallTelemetry>(t => captured.Add(t)), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var sut = CreateSut();
+        await sut.OnAttemptCompletedAsync(Ctx(
+            CachedCallAttemptOutcome.Delivered,
+            channel: "DbOutbound",
+            executionId: executionId,
+            sourceScript: "Plant.Tank/OnAlarm"));
+
+        Assert.Equal(2, captured.Count);
+        var resolve = Assert.Single(captured, p => p.Audit.Kind == AuditKind.CachedResolve);
+        Assert.Equal(executionId, resolve.Audit.ExecutionId);
+        Assert.Equal("Plant.Tank/OnAlarm", resolve.Audit.SourceScript);
+
+        var attempted = Assert.Single(captured, p => p.Audit.Kind == AuditKind.DbWriteCached);
+        Assert.Equal(executionId, attempted.Audit.ExecutionId);
+        Assert.Equal("Plant.Tank/OnAlarm", attempted.Audit.SourceScript);
+    }
+
+    [Fact]
+    public async Task RetryLoopRow_NullExecutionIdAndSourceScript_RemainNull()
+    {
+        // Back-compat: a pre-Task-4 buffered row has no ExecutionId /
+        // SourceScript; the bridge must leave the audit row's fields null
+        // rather than throwing.
+        CachedCallTelemetry? captured = null;
+        _forwarder.ForwardAsync(Arg.Do<CachedCallTelemetry>(t => captured = t), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var sut = CreateSut();
+        await sut.OnAttemptCompletedAsync(Ctx(CachedCallAttemptOutcome.TransientFailure));
+
+        Assert.NotNull(captured);
+        Assert.Null(captured!.Audit.ExecutionId);
+        Assert.Null(captured.Audit.SourceScript);
+    }
 }