docs: rewrite IncrementalSync + AddressSpace for v3, fix driver-specs/driver-stability tier claims, update Secrets runbook for pair replication + KEK rotation (#623)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/Modbus.md

@@ -96,14 +96,15 @@ to the actual offending register(s). Per-tag escape hatch:
 from the driver's `DriverConfig` JSON. Key fields:
 
 - **Endpoint** — `Host`, `Port` (default 502), `UnitId`, `Timeout`. Per-tag `UnitId` overrides drive multi-slave gateway topology.
+- **`Transport`** — `Tcp` (default; MBAP header + transaction id) or `RtuOverTcp` (RTU `[addr][PDU][CRC-16]` framing tunnelled over the socket to a serial-to-Ethernet gateway); string-valued, absent = `Tcp`. The Test Connect probe follows the authored mode.
 - **`Tags`** — the pre-declared `ModbusTagDefinition` list; this *is* the address space.
 - **`Probe`** — connectivity-probe interval / timeout / probe register (default register 0).
 - **Read/write caps** — `MaxRegistersPerRead` (125), `MaxRegistersPerWrite` (123), `MaxCoilsPerRead` (2000), plus `MaxReadGap` and `AutoProhibitReprobeInterval` for coalescing.
 - **Function-code overrides** — `UseFC15ForSingleCoilWrites`, `UseFC16ForSingleRegisterWrites` for PLCs that only accept multi-write codes.
 - **Resilience** — `AutoReconnect`, `KeepAlive`, `IdleDisconnectTimeout`, `Reconnect` backoff, and `WriteOnChangeOnly` redundant-write suppression.
 
-Full per-field descriptions live in `ModbusDriverOptions.cs`. The JSON skeleton
-is reproduced in [docs/v2/driver-specs.md §2](../v2/driver-specs.md).
+Full per-field descriptions live in `ModbusDriverOptions.cs`. The v2-era JSON skeleton
+in [docs/v2/driver-specs.md §2](../v2/driver-specs.md) predates the `Transport` key and the v3 raw-tag model.
 
 ## Testing