fix(modbus): refusals are per-tag Bad, batch health, generation-stamped lifecycle, write status mapping

H4: exception 01/02/03 (and undecodable data) are device refusals - per-tag
Bad with a once-per-tag Warning, no Degraded, and they advance
LastSuccessfulRead (the device answered), so an all-refused driver no longer
trips the 90 s watchdog. 04/05/06 still degrade (answered); 0A/0B degrade
without advancing. Health is one worst-wins write per batch instead of
last-writer-wins per tag. A comms failure on one unit fails the rest of
that unit's batch fast; an unreachable endpoint fails the whole batch fast.
H7: write transport failures map to BadCommunicationError, value overflow and
array length mismatch to BadOutOfRange, conversion failures to
BadTypeMismatch; writes report write-side health (a good write or a refusal
clears a write-side Degraded; a good read does not).
Lifecycle: every health write and the transport/table publish carry a
generation; a superseded init releases its transport and publishes nothing,
a read straddling a re-init cannot degrade the new transport, and the
shutdown's final write cannot clobber a newer init. The tag table is
build-and-swapped (re-init no longer merges into the old table). Teardown
joins the probe/re-probe loops (bounded); a probe answer advances
LastSuccessfulRead and an exception PDU from the device counts as Running.
Transports latch dispose atomically and never reconnect after it.

Refs #741
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusLoggerInjectionTests.cs

@@ -92,7 +92,7 @@ public sealed class ModbusLoggerInjectionTests
 
         // Scan 1 — coalesced read fails. Expect exactly one warning.
         await drv.ReadAsync(["T100", "T102", "T104"], CancellationToken.None);
-        var warnings = logger.Entries.Where(e => e.Level == LogLevel.Warning).ToList();
+        var warnings = logger.Entries.Where(e => e.Level == LogLevel.Warning && e.Message.Contains("auto-prohibited")).ToList();
         warnings.Count.ShouldBe(1);
         warnings[0].Message.ShouldContain("drv-logged");
         warnings[0].Message.ShouldContain("Start=100");
@@ -102,7 +102,13 @@ public sealed class ModbusLoggerInjectionTests
         // the prohibition and skips the merge; even if it didn't, the de-dupe in
         // RecordAutoProhibition would suppress).
         await drv.ReadAsync(["T100", "T102", "T104"], CancellationToken.None);
-        logger.Entries.Count(e => e.Level == LogLevel.Warning).ShouldBe(1, "re-fire of same range stays silent");
+        logger.Entries.Count(e => e.Level == LogLevel.Warning && e.Message.Contains("auto-prohibited"))
+            .ShouldBe(1, "re-fire of same range stays silent");
+        // The protected register's per-tag fallback is a device refusal: one Warning for that tag across
+        // both scans (once-per-tag), and none for its readable neighbours.
+        var refusals = logger.Entries.Where(e => e.Level == LogLevel.Warning && e.Message.Contains("refused")).ToList();
+        refusals.Count.ShouldBe(1);
+        refusals[0].Message.ShouldContain("T102");
 
         await drv.ShutdownAsync(CancellationToken.None);
     }