Path-based NodeIds — decouple client contract from driver address

The pre-refactor design minted OPC UA NodeIds directly from the driver's
FullReference (the native-address string). That had three long-term
problems:

1. OPC UA Part 3 §5.2.2 requires NodeIds to be immutable across a node's
   lifetime. A rename of the underlying device address — Galaxy attribute,
   S7 tag, Modbus register alias — changed the NodeId and broke every
   client that had pinned the previous identifier.
2. Two drivers with coincidentally-matching native addresses (e.g. `temp`
   in Modbus and `temp` in S7 under different Equipment rows) collided on
   the NodeId identifier.
3. TagConfig was being placed verbatim on the wire; for drivers whose
   TagConfig is JSON (every driver shipped today, per the
   CK_Tag_TagConfig_IsJson check constraint), clients saw the raw JSON
   blob as the NodeId string.

Refactor:

* DriverNodeManager.Variable now mints a stable path-based NodeId
  `{driverId}/{folder-path}/{browseName}` and records the driver-side
  FullReference in a new _fullRefByNodeId map. OnReadValue / OnWriteValue
  / ResolveFullRef look the FullReference up via that map instead of
  casting NodeId.Identifier. The old cast path is preserved as a
  fallback so any test fixture that still registers variables with
  FullRef-shaped NodeIds keeps working.

* EquipmentNodeWalker.AddTagVariable now extracts the cross-driver
  `FullName` field from Tag.TagConfig before handing the address to
  DriverAttributeInfo. Every shipped driver stores the wire reference in
  TagConfig[FullName]; falling back to the raw string covers any future
  driver that wants an opaque non-JSON address. ExtractFullName is
  exposed internal for unit coverage.

* scripts/e2e/test-galaxy.ps1 defaults updated to the new path-based
  NodeIds. Verified live against p7-smoke-galaxy on the dev box:
  `ns=2;s=p7-smoke-galaxy/lab-floor/galaxy-line/reactor-1/Source` reads
  return Status=0x00000000 with a real Galaxy byte-array value.

Test suite: 195/195 Core.Tests + 283/283 Server.Tests green. Five new
ExtractFullName / FullName-passthrough tests added.

Task #112 GA-3 — golden-path read verified end-to-end; remaining E2E
script stages still blocked on pre-existing issues (ScriptedAlarm
predicate NRE on empty upstream cache, PowerShell $changeLines.Count
guard), tracked separately.
Task #134 — complete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs

@@ -50,6 +50,15 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     private FolderState? _driverRoot;
     private readonly Dictionary<string, BaseDataVariableState> _variablesByFullRef = new(StringComparer.OrdinalIgnoreCase);
 
+    // NodeId-identifier (string) → driver FullReference. OPC UA Part 3 §5.2.2 requires NodeIds
+    // to be immutable across a node's lifetime, which precludes minting them from the driver's
+    // native address (a backend rename would change the NodeId and break every subscribed
+    // client). NodeIds are therefore path-based (`{driverId}/{folder-path}/{browseName}`) and
+    // this map recovers the driver-side FullReference for read/write/history dispatch. The
+    // fallback in lookups preserves the pre-refactor behaviour for any caller that still
+    // registered a variable via a FullRef-shaped NodeId.
+    private readonly Dictionary<string, string> _fullRefByNodeId = new(StringComparer.Ordinal);
+
     // PR 26: SecurityClassification per variable, populated during Variable() registration.
     // OnWriteValue looks up the classification here to gate the write by the session's roles.
     // Drivers never enforce authz themselves — the classification is discovery-time metadata
@@ -170,12 +179,17 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     {
         lock (Lock)
         {
+            // Path-based NodeId per OPC UA Part 3 §5.2.2 (NodeIds MUST NOT change across the
+            // node's lifetime). Shape `{driverId}/{folder-path}/{browseName}` is stable across
+            // driver-side renames of the underlying FullReference + keeps the identifier
+            // self-describing against the browse tree.
+            var nodeKey = $"{_currentFolder.NodeId.Identifier}/{browseName}";
             var v = new BaseDataVariableState(_currentFolder)
             {
                 SymbolicName = browseName,
                 ReferenceTypeId = ReferenceTypeIds.Organizes,
                 TypeDefinitionId = VariableTypeIds.BaseDataVariableType,
-                NodeId = new NodeId(attributeInfo.FullName, NamespaceIndex),
+                NodeId = new NodeId(nodeKey, NamespaceIndex),
                 BrowseName = new QualifiedName(browseName, NamespaceIndex),
                 DisplayName = new LocalizedText(displayName),
                 DataType = MapDataType(attributeInfo.DriverDataType),
@@ -197,6 +211,7 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
             _securityByFullRef[attributeInfo.FullName] = attributeInfo.SecurityClass;
             _writeIdempotentByFullRef[attributeInfo.FullName] = attributeInfo.WriteIdempotent;
             _sourceByFullRef[attributeInfo.FullName] = attributeInfo.Source;
+            _fullRefByNodeId[nodeKey] = attributeInfo.FullName;
 
             v.OnReadValue = OnReadValue;
             v.OnWriteValue = OnWriteValue;
@@ -228,7 +243,7 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     private ServiceResult OnReadValue(ISystemContext context, NodeState node, NumericRange indexRange,
         QualifiedName dataEncoding, ref object? value, ref StatusCode statusCode, ref DateTime timestamp)
     {
-        var fullRef = node.NodeId.Identifier as string ?? "";
+        var fullRef = NodeIdToFullRef(node.NodeId);
         var source = _sourceByFullRef.TryGetValue(fullRef, out var s) ? s : NodeSourceKind.Driver;
         var readable = SelectReadable(source, _readable, _virtualReadable, _scriptedAlarmReadable);
 
@@ -717,7 +732,7 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     private ServiceResult OnWriteValue(ISystemContext context, NodeState node, NumericRange indexRange,
         QualifiedName dataEncoding, ref object? value, ref StatusCode statusCode, ref DateTime timestamp)
     {
-        var fullRef = node.NodeId.Identifier as string;
+        var fullRef = NodeIdToFullRef(node.NodeId);
         if (string.IsNullOrEmpty(fullRef)) return StatusCodes.BadNodeIdUnknown;
 
         // Per Phase 7 plan decision #6 — virtual tags + scripted alarms reject direct
@@ -1102,7 +1117,23 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
         }
     }
 
-    private string? ResolveFullRef(NodeHandle handle) => handle.NodeId?.Identifier as string;
+    private string? ResolveFullRef(NodeHandle handle)
+    {
+        if (handle.NodeId is null) return null;
+        return NodeIdToFullRef(handle.NodeId);
+    }
+
+    /// <summary>
+    ///     Recover the driver-side FullReference for a given OPC UA <see cref="NodeId"/>. Looks
+    ///     the identifier up in <see cref="_fullRefByNodeId"/>; when no entry exists (e.g. for
+    ///     legacy test fixtures that still register variables with FullRef-shaped NodeIds) we
+    ///     fall through to the raw identifier string so those code paths keep working.
+    /// </summary>
+    private string NodeIdToFullRef(NodeId nodeId)
+    {
+        if (nodeId?.Identifier is not string key) return string.Empty;
+        return _fullRefByNodeId.TryGetValue(key, out var fullRef) ? fullRef : key;
+    }
 
     // Both the results list AND the parallel errors list must be populated — MasterNodeManager
     // merges them and the merged StatusCode is what the client sees. Leaving errors[i] at its