docs: R2-11 TagConfig consolidation + strictness rollout decisions

docs/drivers/FOCAS.md

@@ -15,6 +15,16 @@ OtOpcUa is **read-only** against FOCAS; all reads go over the native wire
 protocol using the documented command IDs. Writes return
 `BadNotWritable` by design.
 
+> **Equipment tags are forced read-only (R2-11, migration note).** The equipment-tag parser
+> (`FocasEquipmentTagParser`) now hard-codes `Writable: false` regardless of any authored
+> `"writable": true` — previously such a tag advertised a writable node whose write always failed at
+> the wire with `BadNotWritable`; now it fails one step earlier at the driver seam (same family of Bad
+> status, no successful operation changes). The AdminUI FOCAS editor shows the Writable checkbox
+> disabled/unchecked, and the deploy gate warns when a config requests `writable:true`. Additionally,
+> equipment-tag references now run the same capability-matrix pre-flight authored tags get: a reference
+> whose address violates the device series' matrix fails to resolve (`BadNodeIdUnknown`) instead of
+> reaching the wire. Honour `writable` here once PMC writes ship in the wire client.
+
 > **PDU version (v3 / FANUC 30i/31i).** The wire client **accepts inbound PDU versions `{1, 3}`**
 > (`FocasWireProtocol`) while still emitting v1 on requests. Older controls + the docker mock answer
 > v1; modern controls (Makino Pro 5 / FANUC **31i-B**) answer v3. **Validated live against a real