fix(probe): Galaxy gRPC ping — drop invalid Retry, treat MxGatewayAuth exceptions as reachable (live /run)

Two bugs caught by live verification against the mxaccessgw at 10.100.0.48:5120:
- MaxAttempts=1 produced an invalid Polly RetryStrategyOptions -> the probe failed
  on every real gateway. Removed the Retry override (matches GalaxyDriver); fail-fast
  is already guaranteed by the TCP preflight + the per-call deadline.
- A rejected key surfaces as a typed MxGatewayAuthenticationException, not a raw
  RpcException, so 'auth-rejection = reachable' was bypassed. Catch the typed auth/
  authorization exceptions -> Ok=true.
Adds DriverProbeHandshakeE2eTests: direct-probe, skip-gated cross-protocol green/red
discrimination (Modbus, OpcUaClient, Galaxy + a local real OPC UA server).

docs/drivers/TestConnectProbes.md

@@ -107,10 +107,20 @@ key string in the transient config (possibly empty or unresolved) is used as-is.
 
 - `Unavailable` / transport failure → `Ok=false` (gateway is down or unreachable).
 - `Unauthenticated` / `PermissionDenied` → **`Ok=true`**,
-  `"gateway reachable & speaking gRPC; auth not checked"` — an auth rejection
+  `"gateway reachable & speaking gRPC (auth not checked)"` — an auth rejection
   proves a live mxaccessgw gRPC server. This is the correct result: the driver's
   own session-layer will handle auth; the probe is testing reachability only.
 
+The mxaccessgw client surfaces a rejected key as a typed
+`MxGatewayAuthenticationException` / `MxGatewayAuthorizationException`, **not** a
+raw `RpcException` — the probe catches both and maps them to the reachable result
+above. (Live verification on `10.100.0.48:5120` with no key returns
+`MxGatewayAuthenticationException("Missing or invalid API key.")` → `Ok=true`.)
+
+> **Config note:** `UseTls` must match the endpoint scheme — `UseTls:false` for an
+> `http://` (h2c) gateway, `UseTls:true` for `https://`. A mismatch fails the
+> client's own validation (the same constraint the Galaxy driver enforces).
+
 ---
 
 ## Live-verify scope