Diagnostic endpoint uses one global lock and flood bucket

Problem/Motivation

CommentFormController::diagnostic() (the POST route /node/{node}/advanced-comment-threads/{field_name}/diagnostic) serializes every client on one lock name, act.diagnostic (src/Controller/CommentFormController.php:121, released at :152). The acquire does not wait, so concurrent reports from unrelated clients get a 429.
It also applies a site-wide global flood bucket, 200 per 300 s with identifier 'all' (:135, registered at :144), so one client can suppress everyone's diagnostics for five minutes.
The fragment routes already scope their lock to the flood identity (CommentFragmentController.php:405). The impact is limited to the availability of a diagnostics-only channel; submissions are not affected.

Steps to reproduce

1. As one client, send 200 valid diagnostic POSTs within 5 minutes. Each needs a fresh stage/outcome combination to pass the entry bucket.
2. As a second client, send one valid diagnostic POST: it gets a 429.

Proposed resolution

• Scope the lock to the client identifier, as the fragment routes do (act.diagnostic.{client}).
• Drop the global bucket. Or keep it as a much higher safety ceiling that only protects the log, and document it. Rely on the client (20/300 s) and entry (1/60 s) buckets.

Remaining tasks

• Change the controller, and add a Kernel test that unrelated clients neither contend for the lock nor share a bucket.

User interface changes

None.

API changes

None.

Data model changes

None.