feat(grpc-events): implement aahCryptV2 token — v8 ExchangeKey auth now passes live

Implements the reverse-engineered v8 credential token in pure managed code and
wires the full event-connection auth chain. Live result: the v8 OpenConnection
now AUTHENTICATES against the 2023 R2 server (past the 132/171 AuthenticationFailed
wall) — the crypto is solved.

- HistorianNativeHandshake.DeriveExchangeKeyClientKey: client key = SHA256(ECDH
  shared secret) via ECDiffieHellman.DeriveKeyFromHash(SHA256), matching the native
  ECDiffieHellmanCng{Hash,SHA256}.DeriveKeyMaterial.
- BuildExchangeKeyCredentialToken + Rc4: token = RC4(password-UTF16LE, key=MD5(clientKey)).
  Reproduces a live-captured token EXACTLY (verified offline) — the native
  HistorianCrypto.NRC4_V2.aahCryptV2 scheme (MD5-keyed RC4). Pure managed; nothing
  AVEVA shipped. RC4 pinned by the standard test vector.
- OpenSession(eventConnection:true): ExchangeKey -> derive client key -> token ->
  v8 OpenConnection with ConnectionType=Event + the token. Orchestrator re-armed.
- HistorianAddTagsProtocol.SerializeCmEventEnsureTagsGrpc: the 86-byte native gRPC
  CM_EVENT EnsureTags (8-byte header + ...2f27 event-type GUID), replacing the
  2020 WCF 83-byte CTagMetadata on the gRPC event registration.

Goldens: RC4 standard vector + token construction. 326/326 offline.

KNOWN REMAINING: the event query still returns zero rows (GetNext yields a 10-byte
zero-row buffer). Auth + StartEventQuery succeed; the query-layer detail (vs the
native row-returning capture) is the last step. Gated test still pins the no-row
throw; opt-in diagnostic (HISTORIAN_GRPC_EVENT_DIAG) surfaces the journey.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

src/AVEVA.Historian.Client/Grpc/HistorianGrpcHandshake.cs

@@ -82,9 +82,12 @@ internal static class HistorianGrpcHandshake
             cancellationToken);
 
         // Event reads require an Event-type connection (ConnectionType=Event), which only the native
-        // v8 OpenConnection format carries — the v6 buffer has no such field. The v8 OpenConnection also
-        // looks up its client key in the registry HistoryService.ExchangeKey (ECDH) populates (not the
-        // one ValidateClientCredential does), so establish that key first via a P-256 key exchange.
+        // v8 OpenConnection format carries — the v6 buffer has no such field. The v8 path authenticates
+        // via HistoryService.ExchangeKey (P-256 ECDH): the shared secret -> SHA256 = the client key, and
+        // the v8 credential token = RC4(password-UTF16LE, key=MD5(clientKey)) (the native HistorianCrypto
+        // aahCryptV2 scheme). The server shares the secret and RC4-decrypts the token to validate the
+        // password. See docs/reverse-engineering/grpc-event-query-capture.md.
+        byte[] eventToken = [];
         if (eventConnection)
         {
             using ECDiffieHellman ecdh = ECDiffieHellman.Create(ECCurve.NamedCurves.nistP256);
@@ -103,12 +106,13 @@ internal static class HistorianGrpcHandshake
                 throw new InvalidOperationException(
                     $"gRPC ExchangeKey failed (errorLen={xkErr.Length}, native={xkDecoded?.Type}/{xkDecoded?.Code}, ascii='{xkAscii}').");
             }
-            // The raw ECDH shared secret (if the v8 credential token later needs derivation) is:
-            // HistorianNativeHandshake.DeriveExchangeKeySecret(ecdh, xk.BtOutput?.ToByteArray() ?? []);
+
+            byte[] clientKey = HistorianNativeHandshake.DeriveExchangeKeyClientKey(ecdh, xk.BtOutput?.ToByteArray() ?? []);
+            eventToken = HistorianNativeHandshake.BuildExchangeKeyCredentialToken(clientKey, options.Password);
         }
 
         byte[] open2Request = eventConnection
-            ? HistorianNativeHandshake.BuildEventOpenConnectionVersion8Request(contextKey, options.UserName)
+            ? HistorianNativeHandshake.BuildEventOpenConnectionVersion8Request(contextKey, options.UserName, eventToken)
             : HistorianNativeHandshake.BuildOpenConnection3Request(options.Host, contextKey, connectionMode);
 
         GrpcHistory.OpenConnectionResponse open2 = historyClient.OpenConnection(