fix(drivers): harden operator TimeoutMs handling + AbLegacy evict parity

Follow-ups from the fleet-wide read-timeout audit that the S7 R2-01 read-leg
fix (PR #453) prompted. The audit confirmed S7 was the ONLY driver with the
async-read-ignores-socket-timeout hang; these are the two adjacent (non-hang)
findings it surfaced.

1. FOCAS TimeoutMs:0 footgun (the risky one): a non-positive Timeout made
   SynchronizedFocasClient DISABLE its per-call wall-clock ceiling, reverting to
   the caller's long-lived poll token — reintroducing exactly the frozen-peer
   wedge S7 just eliminated, under misconfig. Clamp non-positive TimeoutMs to the
   2s default at the config boundary so the deadline can never be authored away.

2. TimeoutMs validation symmetry: apply the same clamp in the AbCip + AbLegacy
   factories. libplctag's Tag.Timeout setter throws on <=0, faulting tag creation
   on every read/write; clamping keeps a misconfigured TimeoutMs:0 running on the
   default bound instead. (Shared PositiveTimeoutOrDefault helper per factory.)

3. AbLegacy reconnect parity with AbCip: AbLegacy evicted the cached libplctag
   runtime on neither the non-zero-status nor transport-exception read/write path
   (AbCip evicts on both), so a data-path fault recovered only via the probe loop
   / libplctag internals. Added EvictRuntime + wired it into both read and write
   failure paths so a fresh handle is created on the next call.

Tests: FOCAS 265->269 (clamp theory + positive), AbCip 336->339 (clamp theory +
positive), AbLegacy 209->212 (read-nonzero / read-exception / write-nonzero evict).
No production regressions; all three driver suites green.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriverFactoryExtensions.cs

@@ -84,9 +84,9 @@ public static class FocasDriverFactoryExtensions
             {
                 Enabled = dto.Probe?.Enabled ?? true,
                 Interval = TimeSpan.FromMilliseconds(dto.Probe?.IntervalMs ?? 5_000),
-                Timeout = TimeSpan.FromMilliseconds(dto.Probe?.TimeoutMs ?? 2_000),
+                Timeout = PositiveTimeoutOrDefault(dto.Probe?.TimeoutMs, 2_000),
             },
-            Timeout = TimeSpan.FromMilliseconds(dto.TimeoutMs ?? 2_000),
+            Timeout = PositiveTimeoutOrDefault(dto.TimeoutMs, 2_000),
             FixedTree = BuildFixedTree(dto.FixedTree),
             AlarmProjection = BuildAlarmProjection(dto.AlarmProjection),
             HandleRecycle = BuildHandleRecycle(dto.HandleRecycle),
@@ -96,6 +96,20 @@ public static class FocasDriverFactoryExtensions
         return new FocasDriver(options, driverInstanceId, clientFactory);
     }
 
+    /// <summary>
+    ///     Maps an operator-supplied timeout (ms) to a positive <see cref="TimeSpan"/>, substituting
+    ///     <paramref name="defaultMs"/> for a null / zero / negative value. A non-positive
+    ///     <c>Timeout</c> would make <see cref="SynchronizedFocasClient"/> DISABLE its per-call
+    ///     wall-clock ceiling (falling back to the caller's long-lived poll token), reintroducing the
+    ///     exact unbounded-read-on-a-frozen-peer wedge the S7 R2-01 read-leg fix eliminated. Clamping
+    ///     here at the config boundary guarantees the deadline can never be authored away.
+    /// </summary>
+    /// <param name="ms">The operator-supplied timeout in milliseconds, or null.</param>
+    /// <param name="defaultMs">The default applied when <paramref name="ms"/> is null or non-positive.</param>
+    /// <returns>A strictly positive timeout.</returns>
+    private static TimeSpan PositiveTimeoutOrDefault(int? ms, int defaultMs) =>
+        TimeSpan.FromMilliseconds(ms is int v and > 0 ? v : defaultMs);
+
     /// <summary>
     ///     Builds the appropriate <see cref="IFocasClientFactory"/> based on the config DTO's backend selection.
     /// </summary>