fix(drivers): harden operator TimeoutMs handling + AbLegacy evict parity

Follow-ups from the fleet-wide read-timeout audit that the S7 R2-01 read-leg
fix (PR #453) prompted. The audit confirmed S7 was the ONLY driver with the
async-read-ignores-socket-timeout hang; these are the two adjacent (non-hang)
findings it surfaced.

1. FOCAS TimeoutMs:0 footgun (the risky one): a non-positive Timeout made
   SynchronizedFocasClient DISABLE its per-call wall-clock ceiling, reverting to
   the caller's long-lived poll token — reintroducing exactly the frozen-peer
   wedge S7 just eliminated, under misconfig. Clamp non-positive TimeoutMs to the
   2s default at the config boundary so the deadline can never be authored away.

2. TimeoutMs validation symmetry: apply the same clamp in the AbCip + AbLegacy
   factories. libplctag's Tag.Timeout setter throws on <=0, faulting tag creation
   on every read/write; clamping keeps a misconfigured TimeoutMs:0 running on the
   default bound instead. (Shared PositiveTimeoutOrDefault helper per factory.)

3. AbLegacy reconnect parity with AbCip: AbLegacy evicted the cached libplctag
   runtime on neither the non-zero-status nor transport-exception read/write path
   (AbCip evicts on both), so a data-path fault recovered only via the probe loop
   / libplctag internals. Added EvictRuntime + wired it into both read and write
   failure paths so a fresh handle is created on the next call.

Tests: FOCAS 265->269 (clamp theory + positive), AbCip 336->339 (clamp theory +
positive), AbLegacy 209->212 (read-nonzero / read-exception / write-nonzero evict).
No production regressions; all three driver suites green.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriverFactoryExtensions.cs

@@ -83,10 +83,10 @@ public static class AbLegacyDriverFactoryExtensions
             {
                 Enabled = dto.Probe?.Enabled ?? true,
                 Interval = TimeSpan.FromMilliseconds(dto.Probe?.IntervalMs ?? 5_000),
-                Timeout = TimeSpan.FromMilliseconds(dto.Probe?.TimeoutMs ?? 2_000),
+                Timeout = PositiveTimeoutOrDefault(dto.Probe?.TimeoutMs, 2_000),
                 ProbeAddress = dto.Probe?.ProbeAddress ?? "S:0",
             },
-            Timeout = TimeSpan.FromMilliseconds(dto.TimeoutMs ?? 2_000),
+            Timeout = PositiveTimeoutOrDefault(dto.TimeoutMs, 2_000),
         };
 
         return new AbLegacyDriver(
@@ -95,6 +95,20 @@ public static class AbLegacyDriverFactoryExtensions
             logger: loggerFactory?.CreateLogger<AbLegacyDriver>());
     }
 
+    /// <summary>
+    ///     Maps an operator-supplied timeout (ms) to a positive <see cref="TimeSpan"/>, substituting
+    ///     <paramref name="defaultMs"/> for a null / zero / negative value. libplctag's managed
+    ///     <c>Tag.Timeout</c> setter throws <see cref="ArgumentOutOfRangeException"/> for a
+    ///     non-positive value, which would otherwise fault tag creation on every read/write; clamping
+    ///     here keeps a misconfigured <c>TimeoutMs: 0</c> running on the default bound instead. (Driver
+    ///     timeout hardening, sibling of the S7 R2-01 read-leg fix.)
+    /// </summary>
+    /// <param name="ms">The operator-supplied timeout in milliseconds, or null.</param>
+    /// <param name="defaultMs">The default applied when <paramref name="ms"/> is null or non-positive.</param>
+    /// <returns>A strictly positive timeout.</returns>
+    private static TimeSpan PositiveTimeoutOrDefault(int? ms, int defaultMs) =>
+        TimeSpan.FromMilliseconds(ms is int v and > 0 ? v : defaultMs);
+
     private static T ParseEnum<T>(string? raw, string driverInstanceId, string field,
         string? tagName = null, T? fallback = null) where T : struct, Enum
     {