feat(opcua,host): #81 ServiceLevel SDK publisher

SdkServiceLevelPublisher writes Server.ServiceLevel through the SDK's
ServerObjectState — the standard OPC UA non-transparent-redundancy signal
clients use to pick a primary. Writes are guarded by DiagnosticsLock so
concurrent SDK diagnostics scans don't fight with our updates.

DeferredServiceLevelPublisher mirrors the DeferredAddressSpaceSink late-
binding pattern: Akka actors resolve IServiceLevelPublisher at construction,
hosted service swaps the SDK publisher in after StandardServer.Start. Host
Program.cs registers DeferredServiceLevelPublisher as the singleton bound
to IServiceLevelPublisher; OtOpcUaServerHostedService gets it injected and
fills it once IServerInternal is available.

Tests boot a real StandardServer on a free port (cross-platform), call
Publish, then verify ServerObject.ServiceLevel.Value reflects the write.
5 new tests; OpcUaServer suite now 45/45 green (was 40, +5).

Closes #81 residual. Unblocks Task 60 (OPC UA dual-endpoint + ServiceLevel
tests).

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -60,6 +60,12 @@ if (hasDriver)
     builder.Services.AddSingleton<IOpcUaAddressSpaceSink>(sp =>
         sp.GetRequiredService<DeferredAddressSpaceSink>());
 
+    // Same late-binding pattern for the ServiceLevel publisher — actor wants it at ctor time,
+    // production SdkServiceLevelPublisher needs IServerInternal which only exists after Start.
+    builder.Services.AddSingleton<DeferredServiceLevelPublisher>();
+    builder.Services.AddSingleton<IServiceLevelPublisher>(sp =>
+        sp.GetRequiredService<DeferredServiceLevelPublisher>());
+
     // F13c — bind UserName tokens to the same LDAP backend the Admin cookie/JWT flows use.
     // ILdapAuthService is registered by AddOtOpcUaAuth on admin nodes; on driver-only nodes
     // it isn't, so we register the LDAP options + service unconditionally for driver hosts