Auto: focas-f4d — password / unlock parameter

Closes #271

scripts/e2e/test-focas.ps1

@@ -56,6 +56,16 @@
   mistargeted bit can move motion or latch a feedhold) so the gate is
   off by default — see docs/v2/focas-deployment.md "Write safety / PMC
   pre-checks".
+
+.PARAMETER CncPassword
+  Issue #271 (F4-d) — optional CNC connection-level password emitted via
+  cnc_wrunlockparam on connect. Required only when the controller gates
+  parameter writes behind a password switch (16i + some 30i firmwares
+  with parameter-protect on). Threaded through to every CLI invocation
+  in the -Write stage as --cnc-password. PASSWORD INVARIANT: never
+  logged — the CLI's Serilog config does not destructure this flag.
+  See docs/v2/focas-deployment.md § "FOCAS password handling" for the
+  no-log invariant + rotation runbook.
 #>
 
 param(
@@ -67,7 +77,8 @@ param(
     [switch]$Write,
     [string]$ParamAddress = "PARAM:1815",
     [string]$MacroAddress = "MACRO:500",
-    [string]$PmcBitAddress = "R100.3"
+    [string]$PmcBitAddress = "R100.3",
+    [string]$CncPassword = ""
 )
 
 $ErrorActionPreference = "Stop"
@@ -86,6 +97,15 @@ $opcUaCli = Get-CliInvocation `
     -ExeName "otopcua-cli"
 
 $commonFocas = @("-h", $CncHost, "-p", $CncPort)
+# F4-d (issue #271) — thread the CNC connection password through to every CLI
+# invocation. The CLI's --cnc-password flag emits cnc_wrunlockparam on connect
+# and the driver's per-call retry path re-issues unlock + retries once on
+# EW_PASSWD. PASSWORD INVARIANT: the password is NOT logged here. Write-Host
+# and Test-* helpers never destructure $commonFocas, but we still avoid
+# Write-Host'ing the array directly; the CLI's Serilog config also redacts.
+if (-not [string]::IsNullOrWhiteSpace($CncPassword)) {
+    $commonFocas += @("--cnc-password", $CncPassword)
+}
 $results = @()
 
 $results += Test-Probe `