feat(grpc-events): ExchangeKey ECDH (Path B) — clears the v8 client-key check

Implements HistoryService.ExchangeKey as a pure-managed P-256 ECDH key exchange
and wires it ahead of the v8 Event OpenConnection.

- HistorianNativeHandshake.BuildExchangeKeyClientHello / DeriveExchangeKeySecret:
  .NET ECDiffieHellman (nistP256); wire format "ECK1" + u32(32) + X(32) + Y(32),
  decoded from the live capture. No native AVEVA dependency.
- HistorianGrpcHandshake.OpenSession(eventConnection: true): runs ExchangeKey on
  the context-key handle before the v8 OpenConnection.
- Guardrail HistorianGrpcHandshakeRoutingTests scoped to the token-loop closure:
  still pins that the Negotiate token loop routes to ValidateClientCredential (not
  ExchangeKey), while allowing the legitimate ExchangeKey call in OpenSession.

Live result: ExchangeKey succeeds (server accepts our public key) and the v8
OpenConnection error advances from 132/34 "Failed to get client key" to 132/171
AuthenticationFailed — the ECDH cleared the client-key layer. The remaining
blocker is the 26-byte v8 credential token, which must be derived from the ECDH
shared secret (token KDF, not yet recovered). Orchestrator stays on v6 (set
eventConnection: true to re-arm once the KDF lands). 323/323 offline.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

src/AVEVA.Historian.Client/Grpc/HistorianGrpcHandshake.cs

@@ -1,3 +1,4 @@
+using System.Security.Cryptography;
 using Google.Protobuf;
 using Grpc.Core;
 using AVEVA.Historian.Client.Wcf;
@@ -81,8 +82,31 @@ internal static class HistorianGrpcHandshake
             cancellationToken);
 
         // Event reads require an Event-type connection (ConnectionType=Event), which only the native
-        // v8 OpenConnection format carries — the v6 buffer has no such field. Reuse the same
-        // ValidateClientCredential session; the v8 credential token is zeroed (auth already done).
+        // v8 OpenConnection format carries — the v6 buffer has no such field. The v8 OpenConnection also
+        // looks up its client key in the registry HistoryService.ExchangeKey (ECDH) populates (not the
+        // one ValidateClientCredential does), so establish that key first via a P-256 key exchange.
+        if (eventConnection)
+        {
+            using ECDiffieHellman ecdh = ECDiffieHellman.Create(ECCurve.NamedCurves.nistP256);
+            byte[] clientHello = HistorianNativeHandshake.BuildExchangeKeyClientHello(ecdh);
+            string xkHandle = contextKey.ToString("D").ToUpperInvariant();
+            GrpcHistory.ExchangeKeyResponse xk = historyClient.ExchangeKey(
+                new GrpcHistory.ExchangeKeyRequest { StrHandle = xkHandle, BtInput = ByteString.CopyFrom(clientHello) },
+                connection.Metadata,
+                Deadline(),
+                cancellationToken);
+            if (!(xk.Status?.BSuccess ?? false))
+            {
+                byte[] xkErr = xk.Status?.BtError?.ToByteArray() ?? [];
+                HistorianNativeError? xkDecoded = HistorianOpen2Protocol.TryReadNativeError(xkErr);
+                string xkAscii = new(xkErr.Where(b => b is >= 0x20 and < 0x7F).Select(b => (char)b).ToArray());
+                throw new InvalidOperationException(
+                    $"gRPC ExchangeKey failed (errorLen={xkErr.Length}, native={xkDecoded?.Type}/{xkDecoded?.Code}, ascii='{xkAscii}').");
+            }
+            // The raw ECDH shared secret (if the v8 credential token later needs derivation) is:
+            // HistorianNativeHandshake.DeriveExchangeKeySecret(ecdh, xk.BtOutput?.ToByteArray() ?? []);
+        }
+
         byte[] open2Request = eventConnection
             ? HistorianNativeHandshake.BuildEventOpenConnectionVersion8Request(contextKey, options.UserName)
             : HistorianNativeHandshake.BuildOpenConnection3Request(options.Host, contextKey, connectionMode);