gRPC M0: probe (R0.4, live-verified) + system-param (R0.3) + shared handshake

Roadmap docs/plans/hcal-roadmap.md, milestone M0 (gRPC parity for the DONE
surface). Now unblocked for live verification by a reachable 2023 R2 server.

- R0.4 Probe over gRPC: new HistorianGrpcProbe calls History/Retrieval/Status
  GetInterfaceVersion (unauthenticated). ProbeAsync routes over gRPC when
  Transport==RemoteGrpc. LIVE-VERIFIED against a real 2023 R2 server — needs no
  credentials (runs before the auth loop), so it works despite the auth blocker.

- R0.3 System parameter over gRPC: new HistorianGrpcStatusClient calls
  StatusService.GetSystemParameter over the authenticated session; routed in the
  dialect. Built + unit-tested (request/response field mapping pinned).
  Live-verification pending an auth fix (see below).

- Extracted the proven auth handshake from HistorianGrpcReadOrchestrator into
  shared Grpc/HistorianGrpcHandshake (reused by read + status + future
  browse/metadata). Repointed the IL structural guardrail test to it.

- Diagnostics: round-failure now decodes the native server error + hex/ASCII
  preview (HistorianNativeHandshake.DescribeError). This surfaced the live auth
  blocker as SEC_E_LOGON_DENIED (0x8009030C) at NTLM round 1 — framing is correct,
  the credential did not validate. Probable cause: stale file password or NAM-domain
  NTLM restriction (Kerberos/RDP works, NTLM denied; no SPN path over the tunnel).

216 unit tests pass; live gRPC probe passes. Sanitization scan clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

tests/AVEVA.Historian.Client.Tests/HistorianGrpcIntegrationTests.cs

@@ -12,6 +12,21 @@ namespace AVEVA.Historian.Client.Tests;
 /// </summary>
 public sealed class HistorianGrpcIntegrationTests
 {
+    [Fact]
+    public async Task ProbeAsync_OverGrpc_ReturnsTrue()
+    {
+        string? host = Environment.GetEnvironmentVariable("HISTORIAN_GRPC_HOST");
+        if (string.IsNullOrWhiteSpace(host))
+        {
+            return;
+        }
+
+        // ProbeAsync calls the unauthenticated GetInterfaceVersion RPCs, so it succeeds even when
+        // credentials are unavailable — no HISTORIAN_USER/PASSWORD required.
+        HistorianClient client = new(BuildOptions(host));
+        Assert.True(await client.ProbeAsync(CancellationToken.None));
+    }
+
     [Fact]
     public async Task ReadRawAsync_OverGrpc_ReturnsAtLeastOneRow()
     {
@@ -37,6 +52,20 @@ public sealed class HistorianGrpcIntegrationTests
         Assert.All(samples, s => Assert.Equal(testTag, s.TagName));
     }
 
+    [Fact]
+    public async Task GetSystemParameterAsync_OverGrpc_ReturnsValue()
+    {
+        string? host = Environment.GetEnvironmentVariable("HISTORIAN_GRPC_HOST");
+        if (string.IsNullOrWhiteSpace(host) || string.IsNullOrEmpty(Environment.GetEnvironmentVariable("HISTORIAN_USER")))
+        {
+            return;
+        }
+
+        HistorianClient client = new(BuildOptions(host));
+        string? version = await client.GetSystemParameterAsync("HistorianVersion", CancellationToken.None);
+        Assert.False(string.IsNullOrWhiteSpace(version));
+    }
+
     private static HistorianClientOptions BuildOptions(string host)
     {
         string? user = Environment.GetEnvironmentVariable("HISTORIAN_USER");