fix(runtime): derive every write bound and Ask from one write timeout (lmxopcua#777)

Three write bounds were configured independently: the inbound-write
gateway's 10 s Ask, DriverHostActor's fixed 8 s Ask of the child, and the
child's own write timeout (5 s + up to 2 s grace) with a fixed 8 s queue
budget. An outer Ask that fires first reports the write failed and the node
reverts while the child is still driving the device, so any write timeout
above ~6 s (or a write dequeued late in its 8 s budget) let the device take
a value the client was told failed.

DriverWriteBounds (Runtime) derives them all from DriverWrites:Timeout:
  token cancel   = Timeout
  abandon        = Timeout + min(Timeout/2, 2 s)            (RunBound)
  queue budget   = RunBound
  child replies  <= queue budget + RunBound                  (ReplyBound)
  host Ask       = ReplyBound + 1 s
  gateway Ask    = host Ask + 1 s
Default Timeout is 10 s (the Tier C Write timeout, so no tier default is
capped below its own policy); host Ask 25 s, gateway Ask 26 s. Tier A/B
writes are still cancelled first by their 2 s / 4 s tier timeouts.

- DriverHostActor takes writeBounds + writeClock, spawns children with them,
  and runs its Ask deadline as a token on the write clock (Infinite Akka
  timeout), so host and child bounds share one clock.
- WriteAttribute gains IssuedAt (write-clock timestamp, stamped by the
  host): the queue budget counts mailbox time too, and a write past it is
  failed BadTimeout and never started - including on arrival. Stale queued
  writes are expired across the whole queue, not only up to a free slot.
- ActorNodeWriteGateway's default Ask = Default.GatewayAsk; the hosted
  service passes the configured one.
- Startup validation (Host DriverWriteBoundsBinding, same warn-and-clamp
  style as ScriptingOptionsBinding): unparsable / non-positive -> default,
  above 5 min -> clamped, and each tier whose default Write timeout exceeds
  the write timeout is named in a Warning (its policy would never take
  effect). The derived bounds are logged at Information. Per-instance
  ResilienceConfig Write overrides arrive with a deployment, so
  DriverCapabilityInvokerFactory warns at spawn (writeTimeoutCeiling).
- appsettings.json documents DriverWrites:Timeout.

Tests (manual clock):
- DriverHostActorWriteAskTests: a held write under a 9 s timeout survives
  an 8.5 s step and succeeds; a token-ignoring write is answered by the
  child's BadTimeout at 9 s + grace, not by the Ask; the Infinite-timeout
  Ask ends exactly at its clock deadline.
- DriverInstanceActorConcurrentWriteTests: a write issued longer ago than
  the queue budget is failed and never reaches the driver; positive control
  at exactly the budget is written.
- DriverWriteBoundsTests: every outer bound covers the inner ones for 0.5 s
  to 300 s timeouts.
- DriverWriteBoundsBindingTests: default fits every tier; 3 s timeout is
  caught at startup with Tier B and C named (not A); bad values fall back
  with a warning; over-max clamps.
- DriverCapabilityInvokerFactoryTests: spawn warns when a Write override
  exceeds the ceiling; no warning within it or without a ceiling.
Mutation checks: a fixed 8 s host Ask on the same clock fails both 9 s host
tests; stamping arrival time instead of IssuedAt fails the issued-at test;
dropping the tier check / factory check fails their tests.

Runtime.Tests 961 passed / 3 skipped at AKKA_TEST_TIMEFACTOR 3 and 1;
Host.Tests 232/232 at 3 and 1; Core.Tests 361 passed / 1 skipped.
Solution Release build: 0 warnings.

ContinuousHistorizationRecorderTypedValueTests (historian) deliberately
left for the historian lane.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverCapabilityInvokerFactory.cs

@@ -33,6 +33,7 @@ public sealed class DriverCapabilityInvokerFactory : IDriverCapabilityInvokerFac
     private readonly DriverResilienceStatusTracker _statusTracker;
     private readonly Func<string, DriverTier> _tierResolver;
     private readonly ILogger? _logger;
+    private readonly TimeSpan? _writeTimeoutCeiling;
     private long _generation;
 
     /// <summary>Construct the factory over the shared resilience infrastructure.</summary>
@@ -41,11 +42,16 @@ public sealed class DriverCapabilityInvokerFactory : IDriverCapabilityInvokerFac
     /// <param name="tierResolver">Resolves a driver type name to its <see cref="DriverTier"/> (e.g. <c>DriverFactoryRegistry.GetTier</c>).</param>
     /// <param name="logger">Optional logger; when non-null, a ResilienceConfig parse diagnostic (malformed JSON,
     ///     unknown capability, misapplied Tier-C recycle) is logged as a warning at <see cref="Create"/> time.</param>
+    /// <param name="writeTimeoutCeiling">The node's operator-write timeout (<c>DriverWrites:Timeout</c>), which
+    ///     cancels every write before the Write policy's own timeout can (lmxopcua#777). When non-null, a driver whose
+    ///     effective Write timeout exceeds it is logged as a warning at <see cref="Create"/> time: that policy timeout
+    ///     never takes effect. Null skips the check.</param>
     public DriverCapabilityInvokerFactory(
         DriverResiliencePipelineBuilder builder,
         DriverResilienceStatusTracker statusTracker,
         Func<string, DriverTier> tierResolver,
-        ILogger? logger = null)
+        ILogger? logger = null,
+        TimeSpan? writeTimeoutCeiling = null)
     {
         ArgumentNullException.ThrowIfNull(builder);
         ArgumentNullException.ThrowIfNull(statusTracker);
@@ -54,6 +60,7 @@ public sealed class DriverCapabilityInvokerFactory : IDriverCapabilityInvokerFac
         _statusTracker = statusTracker;
         _tierResolver = tierResolver;
         _logger = logger;
+        _writeTimeoutCeiling = writeTimeoutCeiling;
     }
 
     /// <inheritdoc />
@@ -68,6 +75,16 @@ public sealed class DriverCapabilityInvokerFactory : IDriverCapabilityInvokerFac
                 driverInstanceId, driverType, diagnostic);
         }
 
+        var writePolicy = options.Resolve(DriverCapability.Write);
+        if (_writeTimeoutCeiling is { } ceiling && TimeSpan.FromSeconds(writePolicy.TimeoutSeconds) > ceiling)
+        {
+            _logger?.LogWarning(
+                "Driver resilience config for instance={DriverInstanceId} type={DriverType}: Write timeout " +
+                "{WriteTimeoutSeconds}s exceeds DriverWrites:Timeout ({WriteTimeoutCeiling}); writes are cancelled at " +
+                "the latter, so the policy timeout never takes effect",
+                driverInstanceId, driverType, writePolicy.TimeoutSeconds, ceiling);
+        }
+
         // Stamp a fresh options generation for this invoker. The generation is part of the pipeline-cache
         // key (01/S-7), so this invoker can only ever read pipelines it built — a lingering old child's
         // late re-cache lands under its OWN (older) generation and is unreachable here. Correctness rests on