feat(wcf): EventReadConnectionModeOverride + cross-platform/bounded C2 spike

Live investigation (direct from a VPN host to the 2023 R2 historian's real WCF
port) showed the certificate transport + NegotiateAuthentication auth work
cross-platform, and that the event-read chain needs the 0x501 event connection
mode for CM_EVENT RegisterTags to succeed (0x402/0x401 fail). Even with
registration succeeding over a window that has events, StartEventQuery returns a
0-row header and long-polls — the same server-side per-connection row gate proven
for gRPC. Adds: EventReadConnectionModeOverride (diagnostic), and spike knobs —
cross-platform cert gate, version-check bypass, per-call timeout, overall budget
with phase-diagnostic dump, connection-mode override.

Claude-Session: https://claude.ai/code/session_012SDSQ3AcaXqPcBtDESBRii

src/AVEVA.Historian.Client/HistorianClientOptions.cs

@@ -64,6 +64,14 @@ public sealed class HistorianClientOptions
     /// </summary>
     public string? ConnectViaAddress { get; init; }
 
+    /// <summary>
+    /// Diagnostic override for the native OpenConnection mode the WCF event-read chain uses (default
+    /// <c>0x402</c>, read-only process). Set to e.g. <c>0x501</c> (event) or <c>0x401</c> (write-enabled)
+    /// to probe whether CM_EVENT registration / event-row retrieval needs a different connection type on a
+    /// 2023 R2 server. Null = the default read-only process mode. Intended for protocol investigation.
+    /// </summary>
+    public uint? EventReadConnectionModeOverride { get; init; }
+
     /// <summary>
     /// For <see cref="HistorianTransport.RemoteGrpc"/>: when true the channel uses TLS
     /// (<c>https://</c>); when false it uses plaintext (<c>http://</c>). Matches the stock