Fix second-pass review findings: subscription leak on rebuild, metrics accuracy, and MxAccess startup recovery

- Preserve and replay subscription ref counts across address space rebuilds to prevent MXAccess subscription leaks
- Mark read timeouts and write failures as unsuccessful in PerformanceMetrics for accurate health reporting
- Add deferred MxAccess reconnect path when initial connection fails at startup
- Update code review document with verified completions and new findings
- Add covering tests for all fixes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.LmxOpcUa.Host/MxAccess/MxAccessClient.cs

@@ -27,6 +27,7 @@ namespace ZB.MOM.WW.LmxOpcUa.Host.MxAccess
 
         private int _connectionHandle;
         private volatile ConnectionState _state = ConnectionState.Disconnected;
+        private bool _proxyEventsAttached;
         private CancellationTokenSource? _monitorCts;
 
         // Handle mappings
@@ -40,6 +41,8 @@ namespace ZB.MOM.WW.LmxOpcUa.Host.MxAccess
         // Pending writes
         private readonly ConcurrentDictionary<int, TaskCompletionSource<bool>> _pendingWrites
             = new ConcurrentDictionary<int, TaskCompletionSource<bool>>();
+        private readonly ConcurrentDictionary<string, ConcurrentDictionary<int, TaskCompletionSource<Vtq>>> _pendingReadsByAddress
+            = new ConcurrentDictionary<string, ConcurrentDictionary<int, TaskCompletionSource<Vtq>>>(StringComparer.OrdinalIgnoreCase);
 
         // Probe
         private string? _probeTag;