fix(s7): connect backoff, worst-state write health, Volatile health, array writes (#602, #610)

STAB-21 ConnectionBackoff in EnsureConnectedAsync; STAB-22 write-pass accumulator with a
write-side Faulted that a clean read does not erase; _health on the Volatile idiom;
S7-016 contiguous array write (Bool arrays stay refused).

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

code-reviews/Driver.S7/findings.md

@@ -495,3 +495,5 @@ open-ended deferral.
 **Recommendation:** Add `int? ArrayCount` and `bool? IsArray` to `S7TagDto` and propagate them through `BuildTag`. Mirror the `S7EquipmentTagParser` semantics (honour `arrayLength` only when `isArray` is true and the value is positive).
 
 **Resolution:** Deferred — requires an AdminUI page/DTO change and a corresponding config-form field addition. Tracked as a follow-up to the array-read Phase 4d work. No code change in this review; the existing init guard-(e) correctly rejects any programmatically-constructed writable array reaching the driver until the DTO is wired.
+
+**Update (2026-10-08, #610 item 2):** the DTO half was already stale — `S7TagDto` is gone and `S7TagDefinitionFactory` reads `isArray`/`arrayLength` from TagConfig. Remaining pieces now done: the driver write path (`EncodeArrayBlock` + one contiguous `WriteBytesAsync`; guard-(e) narrowed to writable **Bool** arrays, which would clobber neighbouring bits), and AdminUI author-time validation in `S7TagConfigModel` (the isArray/arrayLength controls live in the TagModal's generic `TagArrayConfig`, not the S7 editor). Server-side exposure of array writes stays with #610 item 1.