fix(maintenance): own SCL trial client lifetime

[masarray]

Audit finding M-01: unowned read-only trial association

At the exact main base b897203fad3b9276492bd3f6220e6c86d14c59df, SclSafeTrialRunner.RunAsync created a NativeIec61850Client and captured a diagnostic, then exited its try/catch without disposing that client. The native client implements IAsyncDisposable and owns a network association and gates. This read-only, explicit CLI trial route is separate from the live monitoring path.

Fix

Use an await using declaration in the owning trial scope. The client remains alive through ConnectUsingSclAsync and CaptureDiagnosticSnapshot, then is asynchronously released on success, cancellation or failure. Add a deterministic source-contract test to prevent accidental reintroduction of the unowned client. The test does not claim real-device or network validation.

Invariants / scope

• Exactly two files changed: Services/SclSafeTrialRunner.cs and tests/ARSAS.Tests/SclSafeTrialRunnerTests.cs.
• No protocol logic, static DataSet/RCB/GI/report acquisition, production Smart Discovery, engine lock, version, release/tag, SCL payload or test evidence change.
• Existing exit codes/evidence schema and read-only trial capability remain unchanged.
• Follow the existing engineering contract; report CI and packaged smoke on the exact head.
• This PR is one bounded technical repair from the repository maintainability audit tracked by Repository independence, provenance and maintainability hardening #380. Larger architecture changes require a separate reviewed plan and tests.