fix(client-shared): resolve Low code-review findings (Client.Shared-003,004,009,010,011)

- Client.Shared-003: DefaultSessionAdapter.WriteValueAsync / CallMethodAsync
  guard against null/empty Results and throw ServiceResultException with
  the response's ServiceResult code instead of indexing into a missing
  list.
- Client.Shared-004: DefaultSessionAdapter.CloseAsync / HistoryReadRawAsync
  / HistoryReadAggregateAsync use the Session.*Async overloads and honour
  the caller's CancellationToken.
- Client.Shared-009: AcknowledgeAlarmAsync returns the underlying
  ServiceResultException.StatusCode on failure instead of always Good;
  IOpcUaClientService doc updated to describe the new contract.
- Client.Shared-010: ConnectionSettings.CertificateStorePath defaults to
  empty; DefaultApplicationConfigurationFactory resolves the canonical
  PKI path lazily, so per-failover ConnectionSettings copies don't hit
  the filesystem.
- Client.Shared-011: added the alarm-fallback regression test, extracted
  EndpointSelector as a pure static, and added EndpointSelectorTests
  covering security-mode match, Basic256Sha256 preference, fallback,
  diagnostics, hostname rewrite, and null/empty guards.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Models/ConnectionSettings.cs

@@ -41,11 +41,13 @@ public sealed class ConnectionSettings
     public bool AutoAcceptCertificates { get; set; } = true;
 
     /// <summary>
-    ///     Path to the certificate store. Defaults to a subdirectory under LocalApplicationData
-    ///     resolved via <see cref="ClientStoragePaths"/> so the one-shot legacy-folder migration
-    ///     runs before the path is returned.
+    ///     Path to the certificate store. Defaults to <see cref="string.Empty"/>; the
+    ///     consuming application configuration factory resolves the canonical path via
+    ///     <see cref="ClientStoragePaths.GetPkiPath"/> lazily on first connect, so
+    ///     constructing settings — including the throwaway copies built per failover
+    ///     attempt — does not touch disk or run the legacy-folder migration probe.
     /// </summary>
-    public string CertificateStorePath { get; set; } = ClientStoragePaths.GetPkiPath();
+    public string CertificateStorePath { get; set; } = string.Empty;
 
     /// <summary>
     ///     Validates the settings and throws if any required values are missing or invalid.