fix(opcua,drivers): carry driver status sub-codes to clients (#519) + health-write ordering (#517)

#519 — a driver's OPC UA status code now reaches a client with its sub-code intact.
DriverInstanceActor projected the driver's uint onto a 3-state Good/Uncertain/Bad enum
and OtOpcUaNodeManager re-expanded Bad to a bare 0x80000000, so BadNoCommunication,
BadTypeMismatch and BadNotSupported were indistinguishable on the wire and every
driver's status constants (incl. the 16 #497 had just corrected) were diagnostic in
logs only. Resolved by option (b): the raw uint rides AttributeValuePublished ->
AttributeValueUpdate -> IOpcUaAddressSpaceSink.WriteValue, OpcUaQuality is deleted, and
severity classification is a helper (OpcUaStatus.IsGood/IsUncertain/IsBad).

The surface was wider than the issue costed (41 files, not "the sink and 3
implementations"): OpcUaQuality had non-driver producers with no uint to carry.
Each got its natural code — BadInternalError for a failed virtual-tag script,
BadNoCommunication for driver comms loss — and ScriptedAlarmHostActor's pair of
mutually-inverse uint<->enum mappers is deleted, having round-tripped a code the
engine already held. AddressSpaceApplier's removal writes deliberately keep the
generic Bad: not losing a code the driver had is this issue; inventing one for the
deploy path is a separate call.

Behaviour change: WriteAlarmQuality fires its Part 9 event on a status-code change
rather than a severity-bucket change. While the annotation was 3-state those were the
same predicate; now a move between two Bad reasons changes what a subscriber reads.

New SDK-free named constants live on Commons.OpcUa.OpcUaStatus, and
StatusCodeParityTests is widened to cover them — that guard is reflection-driven, so
it can only see a named constant, never an inline literal.

#517 — the symptom is real but the issue named the wrong path and its fix was unsafe.
ShutdownAsync cannot race: DriverInstanceActor calls it from PostStop, after the
mailbox drains. (Core/Hosting/DriverHost, the one class with a concurrent GetHealth,
has no production call site.) InitializeAsync can: it runs on a fire-and-forget
Task.Run, and MTConnectDriver writes Healthy then starts loops that can throw into a
catch which disposes the client before writing Faulted.

Moving the write earlier, as suggested, inverts the terminal state — teardown drains
in-flight loops that write health as they unwind, so a late loop could leave Healthy at
rest with every connection closed. The fix is a bracket (conservative before, terminal
after), applied to MTConnect's init-failure path only; shutdown keeps its single
trailing write, and the rule plus the reachability table are documented on
IDriver.ShutdownAsync.

CalculationDriver.GetHealth returned a hard-coded Healthy that consulted nothing —
Healthy before initialize, after shutdown and after dispose. Now derived from _running.
Its test, named Health_is_always_Connected, asserted the defect and is replaced.

Every new guard was falsified by breaking the production code and watching it go red.
The two sub-code tests each assert two different Bad codes, since a single-code
assertion could pass against a hard-coded constant under the old projection.

Pre-existing failures, verified unchanged on a stashed tree and not chased: 4 in
Driver.AbLegacy.IntegrationTests (slc500/micrologix/plc5 fixtures not up) and 3 in
Host.IntegrationTests.

Closes #517
Closes #519

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmHostActor.cs

@@ -388,28 +388,13 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         // Feed the live value into the upstream the engine subscribes from. #478 — carry the source
         // driver's quality (mapped to an OPC UA StatusCode) so the engine can derive a scripted
         // condition's worst-of-input quality; a Bad/Uncertain input is no longer silently treated as Good.
+        // #519 — the status code rides through verbatim. This used to convert the incoming value onto a
+        // 3-state enum and straight back again through a pair of mutually-inverse mappers, which is where
+        // the input's sub-code was lost before the engine ever cached it.
         _upstream.Push(msg.TagId,
-            new DataValueSnapshot(msg.Value, StatusFromQuality(msg.Quality), msg.TimestampUtc, msg.TimestampUtc));
+            new DataValueSnapshot(msg.Value, msg.StatusCode, msg.TimestampUtc, msg.TimestampUtc));
     }
 
-    /// <summary>#478 — map the 3-state <see cref="OpcUaQuality"/> to an OPC UA StatusCode (severity bits)
-    /// for the engine's read cache. The inverse of <see cref="QualityFromStatus"/>.</summary>
-    private static uint StatusFromQuality(OpcUaQuality quality) => quality switch
-    {
-        OpcUaQuality.Bad => 0x80000000u,
-        OpcUaQuality.Uncertain => 0x40000000u,
-        _ => 0u, // Good
-    };
-
-    /// <summary>#478 — collapse an engine <see cref="ScriptedAlarmEvent.WorstInputStatusCode"/> (top-2
-    /// severity bits) back to the 3-state <see cref="OpcUaQuality"/> the Commons snapshot / node path use.</summary>
-    private static OpcUaQuality QualityFromStatus(uint statusCode) => (statusCode >> 30) switch
-    {
-        0 => OpcUaQuality.Good,
-        1 => OpcUaQuality.Uncertain,
-        _ => OpcUaQuality.Bad,
-    };
-
     private void OnEngineEmission(EngineEmission msg)
     {
         var e = msg.Event;
@@ -430,7 +415,7 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         {
             _publishActor.Tell(new OpcUaPublishActor.AlarmQualityUpdate(
                 AlarmNodeId: e.AlarmId,
-                Quality: QualityFromStatus(e.WorstInputStatusCode),
+                StatusCode: e.WorstInputStatusCode,
                 TimestampUtc: e.TimestampUtc,
                 Realm: AddressSpaceRealm.Uns));
             return;
@@ -715,10 +700,10 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         Shelving: MapShelving(condition.Shelving.Kind),
         Severity: (ushort)SeverityToInt(severity),
         Message: message,
-        // #478 — the condition's Quality is the worst quality across the script's input tags at evaluation
+        // #478 — the condition's status is the worst status across the script's input tags at evaluation
         // time (carried on the event by the engine). A transition fired while an input is Uncertain projects
         // Uncertain here so the full-snapshot write doesn't clobber quality back to Good.
-        Quality: QualityFromStatus(worstInputStatusCode));
+        StatusCode: worstInputStatusCode);
 
     /// <summary>Maps the Core <see cref="ShelvingKind"/> onto the Commons <see cref="AlarmShelvingKind"/>
     /// mirror (the Commons assembly can't see the Core enum).</summary>