feat(heidenhain): read-only, credential and endpoint deploy gates + TagConfig inspector (#803)

- HeidenhainDeployChecks (wired into DraftValidator): HeidenhainTagWritable refuses a
  ReadWrite access level on any Heidenhain tag, so no node is ever advertised writable;
  HeidenhainCredentialPersisted refuses a literal password in DriverConfig/DeviceConfig
  (only blank / secret: / env: references; the value is never echoed);
  HeidenhainConfigInvalid for out-of-range settings or a tagged device without an endpoint.
- EquipmentTagConfigInspector maps Heidenhain to HeidenhainTagDefinitionFactory.Inspect.
- Driver validates only devices that carry tags (an unconfigured default Device1 no longer
  faults the driver).

src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/AdminOperations/EquipmentTagConfigInspector.cs

@@ -65,6 +65,7 @@ public static class EquipmentTagConfigInspector
             [DriverTypeNames.MTConnect]   = MTConnectTagDefinitionFactory.Inspect,
             [DriverTypeNames.Calculation] = CalculationTagDefinitionFactory.Inspect,
             [DriverTypeNames.OpcUaClient] = OpcUaClientTagDefinitionFactory.Inspect,
+            [DriverTypeNames.Heidenhain]  = Driver.Heidenhain.HeidenhainTagDefinitionFactory.Inspect,
         };
 
     /// <summary>Inspects a tag's <c>TagConfig</c> for the given driver type. Returns the driver's warnings,