Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

Full read-only SDK (src/AVEVA.Historian.Client) implementing the CLAUDE.md required
surface against AVEVA Historian's binary WCF protocol — no native AVEVA runtime
dependency. All operations live-verified against a local Historian:

- ProbeAsync, ReadRawAsync, ReadAggregateAsync, ReadAtTimeAsync, ReadEventsAsync
- BrowseTagNamesAsync, GetTagMetadataAsync (17 native data-type codes mapped)
- GetConnectionStatusAsync, GetStoreForwardStatusAsync, GetSystemParameterAsync
- 108/108 unit + integration tests pass

Includes the reverse-engineering toolkit (tools/AVEVA.Historian.ReverseEngineering)
used to decode the protocol: WCF probes, IL inspection via dnlib, and IL-rewrite
instrumentation (instrument-wcf-{write,read}message etc.) plus the .NET Framework
trace harness (tools/AVEVA.Historian.NativeTraceHarness) for parity testing.

Sanitized handoff evidence under docs/reverse-engineering/. Native AVEVA binaries
(current/, aveva-install-x64/, aveva-install-x86/) are gitignored — fetch separately
from the AVEVA installer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/reverse-engineering/wcf-status-localhost.md

@@ -0,0 +1,34 @@
+# WCF Status Evidence
+
+Commands:
+
+```powershell
+dotnet run --no-build --project tools\AVEVA.Historian.ReverseEngineering -- wcf-status localhost 32568
+dotnet run --no-build --project tools\AVEVA.Historian.ReverseEngineering -- wcf-status localhost 32568 Version
+```
+
+Confirmed:
+
+- The local status endpoint is `net.tcp://localhost:32568/Stat`.
+- `IStatusServiceContract2` is a static WCF contract named `Stat` in namespace
+  `aa`. The managed definitions now include `GetSystemParameter`, `GETHI`,
+  `PNGS`, and `PNGP`.
+- `GetInterfaceVersion` returns code `0`, version `0` on the local 2020
+  install.
+- The decompiled `CStatusConnectionWCF.GetServerTime` implementation is a
+  WCF-path stub that returns success without calling the `Stat` service. The
+  managed direct call likewise returns code `0` with size `0` and no buffer.
+
+Observed sanitized localhost results:
+
+- `GetSystemTimeZoneName(handle: 0)` returns code `4` and no value.
+- `IsDBCaseSensitive(handle: 0)` returns code `4`.
+- `GetSystemParameter(handle: 0, "Version")` returns `false` with no error
+  buffer.
+
+Interpretation:
+
+- `Stat` endpoint routing is confirmed, but status operations that require a
+  real client handle are not usable until managed session open is solved.
+- `GetServerTime` should not be promoted into the public SDK as a real server
+  time call from this WCF path; native evidence shows it is a no-op stub here.