feat(arrays): Modbus String[]/BitInRegister[] array writes reachable; table follows the resolver

The Modbus lane (#741 U3) gave the driver String[] and BitInRegister[] holding-register array encoders, and
moved address resolution to ModbusTagAddressResolution (keys first, a bit region coerced to Bool, strict key
reads), but DriverArrayWriteSupport still listed both array shapes read-only (follow-up F1), so a client
write was BadNotWritable before it reached the driver.

Modbus row now mirrors the driver end to end:
- Keys shape only (region + address both present). A string-only addressString tag is resolved by the
  driver with its own family through a parser Core.Abstractions cannot reference, so it stays read-only
  (pinned: the conservative direction).
- Strict reads as the resolver: address an integer 0-65535; a present region / dataType / byteOrder /
  stringByteOrder string must name a member.
- Coils: any dataType (coerced to Bool), <= 1968 coils (FC15).
- HoldingRegisters (FC16, never Bool): numeric, String ((stringLength+1)/2 registers, stringLength >= 1),
  BitInRegister (1 register, bitIndex 0-15, span ending <= 65535), all within maxRegistersPerWrite.
  FC23 is opt-in and never changes the answer.
- Elements convert (ScadaBridge int[] -> Int16 stays writable); only a String / DateTime node over a
  numeric or bit element is left out, since such an element never converts.

Tests: the parity test's PendingF1 exemption and its guard are gone; the parity matrix is now region x
element type x node type against the real WriteAsync with a spec-conformant device (FC15 > 1968 refused),
plus shape edges at every cap boundary (numeric, String, BitInRegister, coil), strict key reads, FC23
on/off, string-only, the ScadaBridge int[] shape and U3 wire bytes. Core.Abstractions row tests and a
composer test (String[] and BitInRegister[] writable; over-cap, no-stringLength and string-only read-only).
Docs: table XML doc, Uns.md, modbus-addressing.md, drivers/Modbus.md, data-plane rules.

Refs #741

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

docs/drivers/Modbus.md

@@ -138,11 +138,15 @@ numeric, String, and BitInRegister array reads.
 **Live-verify** — Mac-verifiable against the simulator at `10.100.0.35:5020` (no fixture
 bring-up required; the sim is always-on on the shared Docker host).
 
-**Array writes** (#610) — a whole-array write goes out as one FC15 (coils) or one FC16 (numeric
-holding registers); the driver refuses rather than splits an FC16 longer than `maxRegistersPerWrite`
-(default 123). The server mirrors that: an array tag is client-writable only when
+**Array writes** (#610, #741) — a whole-array write goes out as one FC15 (coils) or one FC16
+(holding registers: numeric, `String` at `(stringLength+1)/2` registers per element, and
+`BitInRegister` as one FC03 + one FC16 read-modify-write of the span); the driver refuses rather than
+splits an FC16 longer than `maxRegistersPerWrite` (default 123). The server mirrors that: an array tag
+is client-writable only when it is addressed by `region` + `address` keys and
 `arrayLength × registers-per-element` fits the cap (and a coil array ≤ 1968), else its node stays
-read-only — see [Uns.md §Array writes](../Uns.md#array-writes-610), including the upgrade note.
+read-only. A string-only (`addressString`) array stays read-only, because the composer cannot resolve
+it under the driver's family — see [Uns.md §Array writes](../Uns.md#array-writes-610) and
+[modbus-addressing.md §Array writes](../v2/modbus-addressing.md#array-writes-610-741).
 
 **Deferrals** — multi-dimensional arrays (`arrayLength` is always 1-D); per-element historization.