fix(opcua,drivers): carry driver status sub-codes to clients (#519) + health-write ordering (#517)

#519 — a driver's OPC UA status code now reaches a client with its sub-code intact.
DriverInstanceActor projected the driver's uint onto a 3-state Good/Uncertain/Bad enum
and OtOpcUaNodeManager re-expanded Bad to a bare 0x80000000, so BadNoCommunication,
BadTypeMismatch and BadNotSupported were indistinguishable on the wire and every
driver's status constants (incl. the 16 #497 had just corrected) were diagnostic in
logs only. Resolved by option (b): the raw uint rides AttributeValuePublished ->
AttributeValueUpdate -> IOpcUaAddressSpaceSink.WriteValue, OpcUaQuality is deleted, and
severity classification is a helper (OpcUaStatus.IsGood/IsUncertain/IsBad).

The surface was wider than the issue costed (41 files, not "the sink and 3
implementations"): OpcUaQuality had non-driver producers with no uint to carry.
Each got its natural code — BadInternalError for a failed virtual-tag script,
BadNoCommunication for driver comms loss — and ScriptedAlarmHostActor's pair of
mutually-inverse uint<->enum mappers is deleted, having round-tripped a code the
engine already held. AddressSpaceApplier's removal writes deliberately keep the
generic Bad: not losing a code the driver had is this issue; inventing one for the
deploy path is a separate call.

Behaviour change: WriteAlarmQuality fires its Part 9 event on a status-code change
rather than a severity-bucket change. While the annotation was 3-state those were the
same predicate; now a move between two Bad reasons changes what a subscriber reads.

New SDK-free named constants live on Commons.OpcUa.OpcUaStatus, and
StatusCodeParityTests is widened to cover them — that guard is reflection-driven, so
it can only see a named constant, never an inline literal.

#517 — the symptom is real but the issue named the wrong path and its fix was unsafe.
ShutdownAsync cannot race: DriverInstanceActor calls it from PostStop, after the
mailbox drains. (Core/Hosting/DriverHost, the one class with a concurrent GetHealth,
has no production call site.) InitializeAsync can: it runs on a fire-and-forget
Task.Run, and MTConnectDriver writes Healthy then starts loops that can throw into a
catch which disposes the client before writing Faulted.

Moving the write earlier, as suggested, inverts the terminal state — teardown drains
in-flight loops that write health as they unwind, so a late loop could leave Healthy at
rest with every connection closed. The fix is a bracket (conservative before, terminal
after), applied to MTConnect's init-failure path only; shutdown keeps its single
trailing write, and the rule plus the reachability table are documented on
IDriver.ShutdownAsync.

CalculationDriver.GetHealth returned a hard-coded Healthy that consulted nothing —
Healthy before initialize, after shutdown and after dispose. Now derived from _running.
Its test, named Health_is_always_Connected, asserted the defect and is replaced.

Every new guard was falsified by breaking the production code and watching it go red.
The two sub-code tests each assert two different Bad codes, since a single-code
assertion could pass against a hard-coded constant under the old projection.

Pre-existing failures, verified unchanged on a stashed tree and not chased: 4 in
Driver.AbLegacy.IntegrationTests (slc500/micrologix/plc5 fixtures not up) and 3 in
Host.IntegrationTests.

Closes #517
Closes #519

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/NodeManagerArrayTests.cs

@@ -94,7 +94,7 @@ public sealed class NodeManagerArrayTests : IDisposable
             writable: false, historianTagname: null, isArray: true, arrayLength: 3, realm: AddressSpaceRealm.Uns);
 
         var payload = new[] { 1, 2, 3 };
-        nm.WriteValue("eq-1/arrwrite", payload, OpcUaQuality.Good, DateTime.UtcNow, realm: AddressSpaceRealm.Uns);
+        nm.WriteValue("eq-1/arrwrite", payload, OpcUaStatus.Good, DateTime.UtcNow, realm: AddressSpaceRealm.Uns);
 
         var variable = nm.TryGetVariable("eq-1/arrwrite");
         variable.ShouldNotBeNull();
@@ -104,6 +104,47 @@ public sealed class NodeManagerArrayTests : IDisposable
         await host.DisposeAsync();
     }
 
+    /// <summary>
+    ///     Gitea #519, second hop — the node manager hands the caller's status code to the SDK
+    ///     <b>verbatim</b>, sub-code included.
+    ///     <para>It used to re-expand a 3-state enum here (<c>Bad =&gt; StatusCodes.Bad</c>), so every Bad
+    ///     sub-code a driver produced landed on the wire as <c>0x80000000</c>. Boots a real SDK server and
+    ///     reads the created <see cref="BaseDataVariableState"/> back, which is the value an OPC UA client
+    ///     would receive.</para>
+    ///     <para>Asserting two DIFFERENT Bad sub-codes is what makes this falsifiable: under the old
+    ///     projection both collapsed to the same value, so a single-code assertion could pass on a
+    ///     hard-coded constant.</para>
+    /// </summary>
+    [Fact]
+    public async Task WriteValue_hands_the_status_sub_code_to_the_SDK_verbatim()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/subcode", parentFolderNodeId: null, displayName: "subcode", dataType: "Double",
+            writable: false, historianTagname: null, realm: AddressSpaceRealm.Uns);
+
+        nm.WriteValue("eq-1/subcode", null, OpcUaStatus.BadNoCommunication, DateTime.UtcNow,
+            realm: AddressSpaceRealm.Uns);
+
+        var variable = nm.TryGetVariable("eq-1/subcode");
+        variable.ShouldNotBeNull();
+        variable!.StatusCode.ShouldBe((StatusCode)StatusCodes.BadNoCommunication);
+        variable.StatusCode.ShouldNotBe((StatusCode)StatusCodes.Bad,
+            "the sub-code was collapsed to a generic Bad — this is exactly the #519 defect");
+
+        // A different Bad sub-code must land differently.
+        nm.WriteValue("eq-1/subcode", null, 0x80740000u /* BadTypeMismatch */, DateTime.UtcNow,
+            realm: AddressSpaceRealm.Uns);
+        nm.TryGetVariable("eq-1/subcode")!.StatusCode.ShouldBe((StatusCode)StatusCodes.BadTypeMismatch);
+
+        // Uncertain and Good still round-trip.
+        nm.WriteValue("eq-1/subcode", 1.0, OpcUaStatus.Good, DateTime.UtcNow, realm: AddressSpaceRealm.Uns);
+        nm.TryGetVariable("eq-1/subcode")!.StatusCode.ShouldBe((StatusCode)StatusCodes.Good);
+
+        await host.DisposeAsync();
+    }
+
     private async Task<(OpcUaApplicationHost Host, OtOpcUaSdkServer Server)> BootAsync()
     {
         var host = new OpcUaApplicationHost(