fix(notification-outbox): re-align Central UI sandbox Notify API with production

The script-analysis sandbox Notify surface was stale after the Notification
Outbox change: SandboxNotifyTarget.Send returned Task<NotificationResult> and
there was no Status method, while production NotifyTarget.Send returns
Task<string> (a NotificationId) plus NotifyHelper.Status. A script that
test-ran cleanly in the sandbox would not compile against the real site
runtime.

- Move the NotificationDeliveryStatus record from ScadaLink.SiteRuntime.Scripts
  into ScadaLink.Commons.Messages.Notification so both production and the
  CentralUI sandbox reference the exact same type (CentralUI does not, and
  should not, reference SiteRuntime). Production NotifyHelper.Status is
  otherwise untouched.
- Rewrite SandboxNotifyHelper/SandboxNotifyTarget to be a signature-faithful
  no-op fake: Send returns Task<string> (a fake NotificationId), Status returns
  Task<NotificationDeliveryStatus>. Production now enqueues into the site S&F
  engine, which has no central-side equivalent in the sandbox, so the fake no
  longer carries an INotificationDeliveryService.
- Add script-analysis tests proving a script using the new Notify shape both
  diagnoses clean and runs in the sandbox.

src/ScadaLink.CentralUI/ScriptAnalysis/SandboxHostHelpers.cs

@@ -1,5 +1,6 @@
 using System.Data.Common;
 using ScadaLink.Commons.Interfaces.Services;
+using ScadaLink.Commons.Messages.Notification;
 
 namespace ScadaLink.CentralUI.ScriptAnalysis;
 
@@ -80,39 +81,62 @@ public class SandboxDatabaseHelper
     }
 }
 
+/// <summary>
+/// Sandbox mirror of <c>ScadaLink.SiteRuntime.Scripts.NotifyHelper</c> — the
+/// <c>Notify</c> global. Signature-faithful to production so the same user code
+/// (<c>Notify.To(...).Send(...)</c> / <c>Notify.Status(...)</c>) compiles
+/// identically against both surfaces.
+///
+/// In the Notification Outbox design production no longer delivers notification
+/// email inline — <c>Notify.Send</c> enqueues into the site Store-and-Forward
+/// Engine and returns a <c>NotificationId</c>. The sandbox has no S&amp;F engine
+/// and no central, so it is a pure no-op fake: <c>Send</c> returns a generated
+/// fake id and <c>Status</c> returns a placeholder <see cref="NotificationDeliveryStatus"/>.
+/// Nothing is delivered.
+/// </summary>
 public class SandboxNotifyHelper
 {
-    private readonly INotificationDeliveryService? _service;
     private readonly string _instanceName;
 
-    public SandboxNotifyHelper(INotificationDeliveryService? service, string instanceName)
+    public SandboxNotifyHelper(string instanceName)
     {
-        _service = service;
         _instanceName = instanceName;
     }
 
+    /// <summary>Selects the notification list to send to.</summary>
     public SandboxNotifyTarget To(string listName) =>
-        new(listName, _service, _instanceName);
+        new(listName, _instanceName);
+
+    /// <summary>
+    /// Queries the delivery status of a previously-sent notification. The
+    /// sandbox never delivers, so this always reports the placeholder
+    /// <c>Unknown</c> status — it exists for signature fidelity with
+    /// <c>NotifyHelper.Status</c>.
+    /// </summary>
+    public Task<NotificationDeliveryStatus> Status(string notificationId) =>
+        Task.FromResult(new NotificationDeliveryStatus("Unknown", 0, null, null));
 }
 
+/// <summary>
+/// Sandbox mirror of <c>ScadaLink.SiteRuntime.Scripts.NotifyTarget</c> — the
+/// target of <c>Notify.To("listName")</c>.
+/// </summary>
 public class SandboxNotifyTarget
 {
     private readonly string _listName;
-    private readonly INotificationDeliveryService? _service;
     private readonly string _instanceName;
 
-    internal SandboxNotifyTarget(string listName, INotificationDeliveryService? service, string instanceName)
+    internal SandboxNotifyTarget(string listName, string instanceName)
     {
         _listName = listName;
-        _service = service;
         _instanceName = instanceName;
     }
 
-    public Task<NotificationResult> Send(string subject, string message, CancellationToken cancellationToken = default)
-    {
-        if (_service == null)
-            throw new ScriptSandboxException(
-                $"Notify.To(\"{_listName}\").Send(...) — notification service not configured for Test Run.");
-        return _service.SendAsync(_listName, subject, message, _instanceName, cancellationToken);
-    }
+    /// <summary>
+    /// Mirrors <c>NotifyTarget.Send</c> — returns a <c>NotificationId</c>. In
+    /// the sandbox nothing is enqueued or delivered; a fake id is returned so
+    /// the call type-checks identically to production.
+    /// </summary>
+    public Task<string> Send(string subject, string message, CancellationToken cancellationToken = default) =>
+        Task.FromResult(Guid.NewGuid().ToString("N"));
 }

src/ScadaLink.CentralUI/ScriptAnalysis/SandboxScriptHost.cs

@@ -13,9 +13,9 @@ namespace ScadaLink.CentralUI.ScriptAnalysis;
 /// instance. With no instance bound they throw <see cref="ScriptSandboxException"/>;
 /// with one bound (see <see cref="SandboxInstanceContext"/>) they route to it.
 ///
-/// <c>ExternalSystem</c>, <c>Database</c>, <c>Notify</c>, and
-/// <c>Scripts.CallShared</c> run against central's real services and fire for
-/// real — they do not depend on a bound instance.
+/// <c>ExternalSystem</c>, <c>Database</c>, and <c>Scripts.CallShared</c> run
+/// against central's real services and fire for real; <c>Notify</c> is a
+/// signature-faithful no-op fake. None of them depend on a bound instance.
 /// </summary>
 public class SandboxScriptHost
 {
@@ -58,8 +58,8 @@ public interface ISandboxInstanceGateway
 /// the <c>Instance</c> global. Attribute and sibling-script access needs a real
 /// deployed instance: with no gateway wired it throws; with one (a bound
 /// instance) it routes cross-site. <c>ExternalSystem</c>/<c>Database</c>/
-/// <c>Notify</c>/<c>Scripts</c> run against central's real services regardless
-/// of binding.
+/// <c>Scripts</c> run against central's real services regardless of binding;
+/// <c>Notify</c> is a signature-faithful no-op fake.
 /// </summary>
 public class SandboxInstanceContext
 {
@@ -80,7 +80,7 @@ public class SandboxInstanceContext
         _gateway = gateway;
         ExternalSystem = external ?? new SandboxExternalHelper(null, "<sandbox>");
         Database = database ?? new SandboxDatabaseHelper(null, "<sandbox>");
-        Notify = notify ?? new SandboxNotifyHelper(null, "<sandbox>");
+        Notify = notify ?? new SandboxNotifyHelper("<sandbox>");
         Scripts = scripts ?? new SandboxScriptCallHelper(null);
     }
 

src/ScadaLink.CentralUI/ScriptAnalysis/ScriptAnalysisService.cs

@@ -154,11 +154,12 @@ public class ScriptAnalysisService
     /// scripts against <see cref="SandboxInboundScriptHost"/>.
     /// Pure logic + the supplied Parameters always work.
     /// For the SandboxScriptHost surface, <c>Attributes</c> still throws while
-    /// <c>External</c>, <c>Database</c>, and <c>Notify</c> are wired to
-    /// central's real <see cref="IExternalSystemClient"/>,
-    /// <see cref="IDatabaseGateway"/>, and
-    /// <see cref="INotificationDeliveryService"/> — calls fire for real and
-    /// have production-equivalent side effects (HTTP, SQL, SMTP).
+    /// <c>External</c> and <c>Database</c> are wired to central's real
+    /// <see cref="IExternalSystemClient"/> and <see cref="IDatabaseGateway"/> —
+    /// calls fire for real and have production-equivalent side effects (HTTP,
+    /// SQL). <c>Notify</c> is a signature-faithful no-op fake (production
+    /// enqueues into the site Store-and-Forward Engine, which has no
+    /// central-side equivalent in the sandbox).
     /// <c>CallShared</c> compiles and executes the named shared script in the
     /// same sandbox, with a recursion limit of
     /// <see cref="SandboxMaxCallSharedDepth"/>. <c>CallScript</c> still throws
@@ -269,10 +270,13 @@ public class ScriptAnalysisService
 
         var externalClient = _services.GetService<IExternalSystemClient>();
         var databaseGateway = _services.GetService<IDatabaseGateway>();
-        var notifyService = _services.GetService<INotificationDeliveryService>();
         var external = new SandboxExternalHelper(externalClient, instanceLabel);
         var database = new SandboxDatabaseHelper(databaseGateway, instanceLabel);
-        var notify = new SandboxNotifyHelper(notifyService, instanceLabel);
+        // The Notification Outbox sandbox Notify is a pure no-op fake — it
+        // mirrors production signatures so scripts compile identically, but it
+        // does not deliver (production now enqueues into the site S&F engine,
+        // which has no central-side equivalent here).
+        var notify = new SandboxNotifyHelper(instanceLabel);
 
         var compileCache = new Dictionary<string, Script<object>>(StringComparer.Ordinal);
         var compileCacheLock = new object();