fix(driver-ablegacy): resolve Medium code-review finding (Driver.AbLegacy-003)

TryParse now rejects three classes of malformed PCCC address:
- Sub-element + bit-index together (e.g. T4:0.ACC/2) — never valid in PCCC
- File number on I/O/S system files (e.g. I3:0, S2:1) — single-letter only
- Sub-element on non-T/C/R files (e.g. B3:0.DN, N7:0.FOO) — only Timer,
  Counter, and Control files carry structured elements

New helper predicates IsNoFileNumberLetter / IsSubElementFileLetter
keep the parser's intent clear. Regression tests added in AbLegacyAddressTests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyAddress.cs

@@ -102,6 +102,19 @@ public sealed record AbLegacyAddress(
             if (maxBit < 0 || b > maxBit) return null;
         }
 
+        // I/O/S are single-letter system files — they carry no file number in the PCCC spec.
+        // Accepting I3:0 or S2:1 would pass a malformed address straight to libplctag; reject early.
+        if (fileNumber is not null && IsNoFileNumberLetter(letter)) return null;
+
+        // A PCCC address cannot have both a sub-element and a bit index: the word is either
+        // structured (T4:0.ACC) or bit-addressed (N7:0/3), never both.
+        if (subElement is not null && bitIndex is not null) return null;
+
+        // Sub-elements are only meaningful on Timer (T), Counter (C), and Control (R) files —
+        // those are the only structured-element file types in the PCCC spec. Accepting B3:0.DN
+        // or N7:0.FOO would produce an address libplctag silently misinterprets.
+        if (subElement is not null && !IsSubElementFileLetter(letter)) return null;
+
         return new AbLegacyAddress(letter, fileNumber, word, bitIndex, subElement);
     }
 
@@ -122,4 +135,18 @@ public sealed record AbLegacyAddress(
         "N" or "F" or "B" or "L" or "ST" or "T" or "C" or "R" or "I" or "O" or "S" or "A" => true,
         _ => false,
     };
+
+    /// <summary>
+    ///     Returns <see langword="true"/> for file letters that carry no explicit file number in the
+    ///     PCCC spec. <c>I</c> (input), <c>O</c> (output), and <c>S</c> (status) are single-letter
+    ///     system files; a digit after the letter (e.g. <c>I3</c>) is a malformed address.
+    /// </summary>
+    private static bool IsNoFileNumberLetter(string letter) => letter is "I" or "O" or "S";
+
+    /// <summary>
+    ///     Returns <see langword="true"/> for file letters that may carry a sub-element suffix
+    ///     (<c>.ACC</c>, <c>.PRE</c>, etc.). Only Timer (<c>T</c>), Counter (<c>C</c>), and
+    ///     Control (<c>R</c>) files have structured elements in the PCCC spec.
+    /// </summary>
+    private static bool IsSubElementFileLetter(string letter) => letter is "T" or "C" or "R";
 }