gRPC M0: probe (R0.4, live-verified) + system-param (R0.3) + shared handshake

Roadmap docs/plans/hcal-roadmap.md, milestone M0 (gRPC parity for the DONE
surface). Now unblocked for live verification by a reachable 2023 R2 server.

- R0.4 Probe over gRPC: new HistorianGrpcProbe calls History/Retrieval/Status
  GetInterfaceVersion (unauthenticated). ProbeAsync routes over gRPC when
  Transport==RemoteGrpc. LIVE-VERIFIED against a real 2023 R2 server — needs no
  credentials (runs before the auth loop), so it works despite the auth blocker.

- R0.3 System parameter over gRPC: new HistorianGrpcStatusClient calls
  StatusService.GetSystemParameter over the authenticated session; routed in the
  dialect. Built + unit-tested (request/response field mapping pinned).
  Live-verification pending an auth fix (see below).

- Extracted the proven auth handshake from HistorianGrpcReadOrchestrator into
  shared Grpc/HistorianGrpcHandshake (reused by read + status + future
  browse/metadata). Repointed the IL structural guardrail test to it.

- Diagnostics: round-failure now decodes the native server error + hex/ASCII
  preview (HistorianNativeHandshake.DescribeError). This surfaced the live auth
  blocker as SEC_E_LOGON_DENIED (0x8009030C) at NTLM round 1 — framing is correct,
  the credential did not validate. Probable cause: stale file password or NAM-domain
  NTLM restriction (Kerberos/RDP works, NTLM denied; no SPN path over the tunnel).

216 unit tests pass; live gRPC probe passes. Sanitization scan clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

src/AVEVA.Historian.Client/Wcf/HistorianNativeHandshake.cs

@@ -33,7 +33,7 @@ internal static class HistorianNativeHandshake
     /// upper-case context-key GUID, <paramref name="wrappedToken"/> is the AVEVA-wrapped SSPI
     /// token (round byte + length + token). The WCF path maps this to
     /// <c>Hist.ValidateClientCredential</c>; the gRPC path maps it to
-    /// <c>HistoryService.ExchangeKey</c> (the renamed handshake op).
+    /// <c>StorageService.ValidateClientCredential</c> (the op that kept the 2020 token framing).
     /// </summary>
     internal delegate TokenExchangeResult TokenExchange(string handle, byte[] wrappedToken, int round);
 
@@ -70,7 +70,8 @@ internal static class HistorianNativeHandshake
 
             if (!result.Success)
             {
-                throw new InvalidOperationException($"Credential token round {round} rejected (errorLen={error.Length}).");
+                throw new InvalidOperationException(
+                    $"Credential token round {round} rejected (errorLen={error.Length}).{DescribeError(error)}");
             }
 
             ValidateClientCredentialResponse? response = HistorianWcfAuthenticationProtocol.TryReadValidateClientCredentialResponse(serverOutput);
@@ -162,4 +163,32 @@ internal static class HistorianNativeHandshake
         int slash = userName.IndexOf('\\');
         return slash > 0 ? userName[(slash + 1)..] : userName;
     }
+
+    /// <summary>
+    /// Renders a diagnostic suffix for a rejected credential round: the decoded native error
+    /// (type/code/name) plus a short hex + printable-ASCII preview of the server error buffer.
+    /// Keeps secrets out — error buffers carry server status codes/messages, not credentials.
+    /// </summary>
+    private static string DescribeError(byte[] error)
+    {
+        if (error.Length == 0)
+        {
+            return string.Empty;
+        }
+
+        HistorianNativeError? native = HistorianOpen2Protocol.TryReadNativeError(error);
+        string nativePart = native is null
+            ? string.Empty
+            : $" native(type={native.Type}, code={native.Code}{(native.Name is null ? string.Empty : $", {native.Name}")})";
+
+        ReadOnlySpan<byte> preview = error.AsSpan(0, Math.Min(error.Length, 64));
+        string hex = Convert.ToHexString(preview);
+        char[] ascii = new char[preview.Length];
+        for (int i = 0; i < preview.Length; i++)
+        {
+            ascii[i] = preview[i] is >= 0x20 and < 0x7F ? (char)preview[i] : '.';
+        }
+
+        return $"{nativePart} hex={hex} ascii=\"{new string(ascii)}\"";
+    }
 }