fix(ab): a refused operation is BadNotSupported, not a comms fault (Task 22 review r1; closes #571)

Native is the default, so a locally refused write must not look like a comms fault.

- AbLegacy: an AbTransportException with AbStatus.Unsupported (status-bit sub-element writes, PLC-5
  non-N reads, all PLC-5 writes; libplctag's ErrorUnsupported maps here too) now returns
  BadNotSupported on both the read and the write path (incl. the bit-RMW path). The tag handle is
  not evicted and driver health is not touched. A native runtime whose init read is refused locally
  is CACHED rather than disposed, so a poll of a refused tag does not re-create (and re-lease the
  pooled connection) every cycle.
- AbCip: the same mapping on the write path and both read paths (single + whole-UDT).
- Uses the existing named BadNotSupported constants (StatusCodeParityTests guard).
- Tests (falsified by disabling the mapping, and separately the keep-on-refusal): status-bit
  writes and PLC-5 read/write through the driver over the native runtime — BadNotSupported, zero
  wire requests, one create, health unchanged; AbCip refused read/write via a refusing fake plus a
  control that a non-refusal failure still evicts and degrades.
- Docs/CLAUDE.md: BadNotSupported; #571 known-gap wording removed.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/AbCip.md

@@ -159,6 +159,9 @@ The driver has two interchangeable wire transports, selected by one `DriverConfi
   alignment pad (84, not 82) (#570).
 - Status-bit sub-element writes (e.g. `T4:0.DN`) are Unsupported natively (they would clobber the control
   word); nothing goes on the wire. Sub-element arrays are Unsupported natively.
+- **A refused operation is not a comms fault.** Any operation a runtime refuses as Unsupported (in AbCip, e.g.
+  a native write whose type cannot be determined) reaches the client as `BadNotSupported`, keeps the tag
+  handle, and leaves driver health unchanged; only real transport failures evict and degrade.
 
 ## Known gaps
 

docs/drivers/AbLegacy.md

@@ -134,10 +134,8 @@ Native routing: SLC500/MicroLogix/PLC-5 are direct; `logixpccc` uses Unconnected
 
 - ⚠️ **Status-bit writes are refused on the default.** An SLC 500 / MicroLogix driver on the native default
   **refuses writes to status-bit sub-elements** — `T4:0.DN`, `T4:0.TT`, `T4:0.EN`, `C5:0.CU`, `C5:0.DN`,
-  `R6:0.EN`, and the rest. The client sees **`BadCommunicationError`** (not `BadNotSupported`: the driver's
-  write path maps the refusal like any transport failure, as for the PLC-5 refusal in #571), the tag's handle
-  is evicted, and driver health goes `Degraded` with "Writes to a status-bit sub-element … are not supported by
-  the native transport". **Nothing is written to the PLC.** libplctag performed a masked bit write here, so an
+  `R6:0.EN`, and the rest. The client sees **`BadNotSupported`**. It is not treated as a comms fault: the
+  tag's handle is kept and driver health is unchanged. **Nothing is written to the PLC.** libplctag performed a masked bit write here, so an
   authored writable status-bit tag that worked before the upgrade fails after it. This is deliberate: a native
   read-modify-write of the control word would race the PLC updating TT/DN and could clobber EN/TT/DN, and such
   writes are rare. **Drivers that need them must set `"transport": "Libplctag"`.** Reads of status bits are
@@ -164,8 +162,8 @@ Native routing: SLC500/MicroLogix/PLC-5 are direct; `logixpccc` uses Unconnected
 
 - ⚠️ **Simulator-only.** PCCC reads and writes are verified against `ab_server` only. No real SLC/MicroLogix/
   PLC-5 has been exercised; the real-press gate (Task 21) was read-only and AbCip-only.
-- **PLC-5 native is N-file reads only.** Every other file type and all PLC-5 writes are refused, currently
-  surfacing as `BadCommunicationError` rather than `BadNotSupported` (#571). The default excludes PLC-5 and
+- **PLC-5 native is N-file reads only.** Every other file type and all PLC-5 writes are refused before the
+  wire and reach the client as `BadNotSupported` (handle kept, health unchanged; #571 closed). The default excludes PLC-5 and
   `logixpccc` (they resolve to libplctag unless `Native` is set explicitly).
 - Status-bit sub-element writes (e.g. `T4:0.DN`, `C5:0.DN`) are Unsupported natively (they would clobber the
   control word); nothing goes on the wire. Sub-element arrays are Unsupported natively. L-file bit indexes