feat(grpc-events): implement aahCryptV2 token — v8 ExchangeKey auth now passes live

Implements the reverse-engineered v8 credential token in pure managed code and
wires the full event-connection auth chain. Live result: the v8 OpenConnection
now AUTHENTICATES against the 2023 R2 server (past the 132/171 AuthenticationFailed
wall) — the crypto is solved.

- HistorianNativeHandshake.DeriveExchangeKeyClientKey: client key = SHA256(ECDH
  shared secret) via ECDiffieHellman.DeriveKeyFromHash(SHA256), matching the native
  ECDiffieHellmanCng{Hash,SHA256}.DeriveKeyMaterial.
- BuildExchangeKeyCredentialToken + Rc4: token = RC4(password-UTF16LE, key=MD5(clientKey)).
  Reproduces a live-captured token EXACTLY (verified offline) — the native
  HistorianCrypto.NRC4_V2.aahCryptV2 scheme (MD5-keyed RC4). Pure managed; nothing
  AVEVA shipped. RC4 pinned by the standard test vector.
- OpenSession(eventConnection:true): ExchangeKey -> derive client key -> token ->
  v8 OpenConnection with ConnectionType=Event + the token. Orchestrator re-armed.
- HistorianAddTagsProtocol.SerializeCmEventEnsureTagsGrpc: the 86-byte native gRPC
  CM_EVENT EnsureTags (8-byte header + ...2f27 event-type GUID), replacing the
  2020 WCF 83-byte CTagMetadata on the gRPC event registration.

Goldens: RC4 standard vector + token construction. 326/326 offline.

KNOWN REMAINING: the event query still returns zero rows (GetNext yields a 10-byte
zero-row buffer). Auth + StartEventQuery succeed; the query-layer detail (vs the
native row-returning capture) is the last step. Gated test still pins the no-row
throw; opt-in diagnostic (HISTORIAN_GRPC_EVENT_DIAG) surfaces the journey.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

tests/AVEVA.Historian.Client.Tests/WcfOpen2ProtocolTests.cs

@@ -5,6 +5,32 @@ namespace AVEVA.Historian.Client.Tests;
 
 public sealed class WcfOpen2ProtocolTests
 {
+    [Fact]
+    public void Rc4MatchesStandardTestVector()
+    {
+        // Standard RC4 test vector (key "Key", plaintext "Plaintext" -> BBF316E8D940AF0AD3). Pins the
+        // RC4 used by the v8 credential token = RC4(password-UTF16LE, key=MD5(SHA256(ECDH secret))).
+        byte[] actual = HistorianNativeHandshake.Rc4(
+            System.Text.Encoding.ASCII.GetBytes("Key"),
+            System.Text.Encoding.ASCII.GetBytes("Plaintext"));
+
+        Assert.Equal(Convert.FromHexString("BBF316E8D940AF0AD3"), actual);
+    }
+
+    [Fact]
+    public void CredentialToken_IsRc4OfPasswordKeyedByMd5OfClientKey()
+    {
+        // token = RC4(password-UTF16LE, key = MD5(clientKey)). Verify against an independently computed
+        // reference for a fixed clientKey + password.
+        byte[] clientKey = Enumerable.Range(0, 32).Select(i => (byte)i).ToArray();
+        byte[] token = HistorianNativeHandshake.BuildExchangeKeyCredentialToken(clientKey, "Pw1!");
+
+        byte[] rc4Key = System.Security.Cryptography.MD5.HashData(clientKey);
+        byte[] expected = HistorianNativeHandshake.Rc4(rc4Key, System.Text.Encoding.Unicode.GetBytes("Pw1!"));
+        Assert.Equal(expected, token);
+        Assert.Equal("Pw1!".Length * 2, token.Length); // UTF-16LE length
+    }
+
     [Fact]
     public void Version8EventSerializerReproducesCapturedNativeStructure()
     {