feat(drivers): every driver reports the authored tags it skipped (Gitea #541)

A driver builds its RawPath -> definition table at init and tolerates a
per-tag miss: an unmappable TagConfig, an unparseable address, a
capability-matrix rejection. That tolerance is right -- one bad tag must not
take down the other few thousand. What was missing is any statement of the
fact afterwards. A skip is not an error and happens before any read, so the
driver stays Healthy, errors/5 min stays 0, Last error stays empty, and Last
read advances live off the tags that did map. On the wonder Makino in #540
that reading held while focas-z-34184 ignored 20 of its 22 tags.

New optional capability ISkippedTagReporter, backed by a shared
SkippedTagLedger so the reset/commit/cap rules are one implementation rather
than one per driver. The report -- authored count, exact skipped count, and a
capped sample of RawPath + reason -- rides DriverHealthChanged to a new Tags
column on /hosts, over the Phase 5 telemetry stream. No table: a driver-only
node has no ConfigDb to write to, the lesson from #521.

The issue named eight drivers. It is twelve -- every driver in
DriverTypeNames.All has an authored-tag skip path. Calculation (no scriptId),
MTConnect (no readable DataItem id), Galaxy (no attributeRef) and OpcUaClient
(no nodeId) were unlisted, and OpcUaClient's was the quietest of the twelve:
NamespaceMap drops such an entry with a bare `continue` and not even a log
line. SkippedTagReporterFleetTests pins the invariant reflectively over every
IDriver in src/Drivers/, so a thirteenth cannot re-introduce the silence.

Sql drops a tag at TWO points and its report is the union of both: a blob
that does not map, AND an identifier the 8.1 catalog gate rejects against the
live catalog. The second is what schema drift produces -- a renamed column, a
dropped view -- months after a deployment sealed green, and reporting only
the first would have that driver claim "0 skipped" while polling half its
tags, which is worse than reporting nothing because the column would then be
actively reassuring.

Deliberately additive to driver state, never a change of it. Latching
non-Healthy for a config problem would satisfy both halves of the #527
comms-loss conjunction -- 90 s without a successful read AND non-Healthy --
and a driver whose tags were ALL skipped has no successful reads by
construction, so it would reconnect-loop forever against a healthy device.

Three details that are load-bearing rather than incidental:

- The skip digest is part of the publish fingerprint. A skipped tag leaves
  every other fingerprint component identical to a clean driver's, so without
  it PublishHealthSnapshot's dedup swallows exactly the publish carrying the
  signal -- the trap that already bit the rediscovery and host-status
  channels. The digest covers the sample, not just the counts: a redeploy
  that fixes one tag and breaks another leaves both counts unchanged.
- The count is exact; only the sample is capped, and the tooltip says so when
  it is showing fewer than it counted. A truncated list that looked complete
  would have an operator fix twenty tags and believe the job done.
- The ledger stages and commits, so an init that throws part-way leaves the
  previous report standing. A partial snapshot would read as "we now skip
  fewer tags", the opposite of the truth.

The proto field needs no companion presence flag, unlike host_statuses: a
singular message field carries real presence in proto3, and a has_ flag would
collide with protoc's generated HasSkippedTags.

Verified red-first three ways: dropping SkippedTagDigest from the fingerprint
fails the two dedup tests, removing the seam from one driver fails the fleet
guard, and dropping the catalog-gate leg fails the Sql union test. Full
solution builds with zero new warnings against 4e22f024.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriver.cs

@@ -27,8 +27,41 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
 ///     manufacture an exception to force backoff.</para>
 /// </summary>
 public sealed class SqlDriver
-    : IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IAsyncDisposable
+    : IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, ISkippedTagReporter, IAsyncDisposable
 {
+    /// <summary>Authored tags this driver could not build into its poll table (Gitea #541).</summary>
+    private readonly SkippedTagLedger _skippedTags = new();
+
+    /// <summary>
+    ///     Blob-level skips from the most recent <see cref="BuildTagTable"/>, retained because Sql drops a
+    ///     tag at TWO points and the report must be the union of both.
+    /// </summary>
+    /// <remarks>
+    ///     A tag can fail to map from its blob (<see cref="BuildTagTable"/>) OR be rejected against the live
+    ///     catalog (<see cref="ApplyCatalogGateAsync"/>) — a renamed column, a dropped view. Both leave the
+    ///     tag out of the polled table publishing <c>BadNodeIdUnknown</c> with the driver Healthy, so both
+    ///     are skips. Reporting only the first would make a Sql driver that lost half its tags to schema
+    ///     drift claim "0 skipped", which is worse than saying nothing at all.
+    /// </remarks>
+    private IReadOnlyList<SkippedTag> _blobSkips = [];
+
+    /// <inheritdoc />
+    public SkippedTagReport GetSkippedTags() => _skippedTags.Snapshot();
+
+    /// <summary>
+    ///     Republishes the skip ledger as the union of the blob-level skips and the catalog gate's
+    ///     rejections, against the true authored denominator (<c>RawTags.Count</c>, not the post-mapping
+    ///     table size — a tag that failed to map is still a tag the operator authored).
+    /// </summary>
+    /// <param name="gateRejections">Catalog-gate rejections; empty before the gate has run.</param>
+    private void PublishSkipLedger(IEnumerable<SkippedTag> gateRejections)
+    {
+        _skippedTags.BeginRebuild(_options.RawTags.Count);
+        foreach (var skip in _blobSkips) _skippedTags.Skip(skip.RawPath, skip.Reason);
+        foreach (var skip in gateRejections) _skippedTags.Skip(skip.RawPath, skip.Reason);
+        _skippedTags.Commit();
+    }
+
     /// <summary>
     ///     The driver-type string this driver registers under — <see cref="DriverTypeNames.Sql"/>, the single
     ///     source of truth the deploy pipeline stores in <c>DriverInstance.DriverType</c> and every dispatch
@@ -699,6 +732,7 @@ public sealed class SqlDriver
     private void BuildTagTable()
     {
         var table = new Dictionary<string, SqlTagDefinition>(_options.RawTags.Count, StringComparer.Ordinal);
+        var blobSkips = new List<SkippedTag>();
         foreach (var entry in _options.RawTags)
         {
             try
@@ -706,9 +740,12 @@ public sealed class SqlDriver
                 if (SqlEquipmentTagParser.TryParse(entry.TagConfig, entry.RawPath, out var definition))
                     table[entry.RawPath] = definition;
                 else
+                {
+                    blobSkips.Add(new SkippedTag(entry.RawPath, "TagConfig did not map to a definition"));
                     _logger.LogWarning(
                         "Sql tag config did not map to a definition; skipping. Driver={DriverInstanceId} RawPath={RawPath}",
                         _driverInstanceId, entry.RawPath);
+                }
             }
             catch (Exception ex)
             {
@@ -717,12 +754,19 @@ public sealed class SqlDriver
                 // strand health at Initializing across every DriverInstanceActor retry. Skip the offending
                 // tag — the same "one bad tag must not take the whole driver down" rule the malformed-blob
                 // branch above follows — rather than fault the driver over a single entry.
+                blobSkips.Add(new SkippedTag(entry.RawPath, $"TagConfig threw while parsing: {ex.GetType().Name}"));
                 _logger.LogError(
                     ex, "Sql tag config threw while parsing; skipping. Driver={DriverInstanceId} RawPath={RawPath}",
                     _driverInstanceId, entry.RawPath);
             }
         }
 
+        // The gate has not run yet, so the report covers blob-level skips only; ApplyCatalogGateAsync
+        // republishes it with its own rejections folded in. Publishing here rather than waiting means a
+        // driver whose gate never runs (nothing authored, or the gate threw) still reports what it knows.
+        _blobSkips = blobSkips;
+        PublishSkipLedger([]);
+
         Volatile.Write(ref _tagsByRawPath, table);
 
         // Nothing is pollable until the catalog gate has validated it. Clearing here (rather than leaving a
@@ -775,6 +819,11 @@ public sealed class SqlDriver
 
         var result = SqlCatalogGate.Apply(authored.Values, catalog, _dialect);
 
+        // Gitea #541: a gate rejection leaves the tag unpolled and publishing BadNodeIdUnknown with the
+        // driver Healthy — the same invisible outcome as a blob that did not map, so it is the same signal.
+        PublishSkipLedger(result.Rejected.Select(r =>
+            new SkippedTag(r.RawPath, $"rejected by the catalog gate: {r.Field} — {r.Reason}")));
+
         foreach (var rejection in result.Rejected)
         {
             _logger.LogWarning(