perf(s7): fail the rest of a pass fast once the handle is dead (R07:P1)

No read or write loop checked _plcDead between items: on a frozen-but-
established peer the first op blew its deadline and marked the handle dead,
and every remaining span / tag / write still went to the wire and could wait
its own deadline under _gate (a 20-span pass ~100 s), with Degraded and the
comms-loss watchdog's clock deferred until the pass ended.

- The span loop, the multi-var chunk loop, the per-tag loop and the write
  loop stamp BadCommunicationError without I/O once _plcDead is set.
- A multi-var chunk that dies on a transport loss (socket / IO / timeout /
  ConnectionError) marks the handle dead instead of falling back to one
  doomed per-tag read per member. The framing class is deliberately excluded
  there: snap7/S7.Net report a multi-var with one refused item as
  ReadData(WrongNumberReceivedBytes) over a healthy stream.
- Live gate via an in-test freezable TCP proxy (counts request frames, not
  seconds). Mutation shows S7.Net 0.20 already self-closes on a cancelled op,
  so the gate pins the end-to-end property; the driver guard itself is proven
  by the unit tests (an op that ignores its token keeps the socket open).

Refs #742
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

docs/drivers/S7.md

@@ -336,6 +336,14 @@ degrades health nor reopens the connection, and because it proves the CPU is rea
 every tag was refused (a wrong DB number) sat `Degraded` with a frozen timestamp and the comms-loss
 watchdog reconnected it every 90 s against a perfectly reachable PLC.
 
+**A dead handle ends the pass's wire traffic (R07:P1).** Once a read pass or write batch marks the
+connection dead (a wire op blew its deadline on a frozen-but-established peer, a socket dropped), the
+remaining spans / multi-var chunks / tags / writes of that pass are stamped `BadCommunicationError`
+without I/O; the next call reopens. A multi-var chunk that dies on a transport loss no longer falls back
+to one doomed per-tag read per member. Without this an op that ignores its cancellation token would cost
+one full deadline per remaining item under the gate, and `Degraded` (and so the comms-loss watchdog's
+clock) only became visible after the whole pass.
+
 **Connect backoff.** A dead PLC costs one connect attempt per backoff window (1 s doubling to a 30 s
 cap), not one per read / poll tick / probe tick: inside the window `EnsureConnectedAsync` fails fast
 (`BadCommunicationError`, `Degraded`) without a connect. A successful connect clears the window, so a