fix(drivers): harden operator TimeoutMs handling + AbLegacy evict parity

Follow-ups from the fleet-wide read-timeout audit that the S7 R2-01 read-leg
fix (PR #453) prompted. The audit confirmed S7 was the ONLY driver with the
async-read-ignores-socket-timeout hang; these are the two adjacent (non-hang)
findings it surfaced.

1. FOCAS TimeoutMs:0 footgun (the risky one): a non-positive Timeout made
   SynchronizedFocasClient DISABLE its per-call wall-clock ceiling, reverting to
   the caller's long-lived poll token — reintroducing exactly the frozen-peer
   wedge S7 just eliminated, under misconfig. Clamp non-positive TimeoutMs to the
   2s default at the config boundary so the deadline can never be authored away.

2. TimeoutMs validation symmetry: apply the same clamp in the AbCip + AbLegacy
   factories. libplctag's Tag.Timeout setter throws on <=0, faulting tag creation
   on every read/write; clamping keeps a misconfigured TimeoutMs:0 running on the
   default bound instead. (Shared PositiveTimeoutOrDefault helper per factory.)

3. AbLegacy reconnect parity with AbCip: AbLegacy evicted the cached libplctag
   runtime on neither the non-zero-status nor transport-exception read/write path
   (AbCip evicts on both), so a data-path fault recovered only via the probe loop
   / libplctag internals. Added EvictRuntime + wired it into both read and write
   failure paths so a fresh handle is created on the next call.

Tests: FOCAS 265->269 (clamp theory + positive), AbCip 336->339 (clamp theory +
positive), AbLegacy 209->212 (read-nonzero / read-exception / write-nonzero evict).
No production regressions; all three driver suites green.

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipFactoryArrayTagTests.cs

@@ -17,6 +17,33 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
 [Trait("Category", "Unit")]
 public sealed class AbCipFactoryArrayTagTests
 {
+    /// <summary>
+    ///     A non-positive <c>TimeoutMs</c> clamps to the 2 s default rather than reaching libplctag's
+    ///     <c>Tag.Timeout</c> setter (which throws <see cref="ArgumentOutOfRangeException"/> for a
+    ///     non-positive value, faulting every read/write). Driver timeout hardening.
+    /// </summary>
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void ParseOptions_clamps_non_positive_TimeoutMs_to_the_default(int timeoutMs)
+    {
+        var json = $$$"""{"TimeoutMs":{{{timeoutMs}}},"Probe":{"TimeoutMs":{{{timeoutMs}}}}}""";
+
+        var opts = AbCipDriverFactoryExtensions.ParseOptions("drv-1", json);
+
+        opts.Timeout.ShouldBe(TimeSpan.FromMilliseconds(2_000));
+        opts.Timeout.ShouldBeGreaterThan(TimeSpan.Zero);
+        opts.Probe.Timeout.ShouldBe(TimeSpan.FromMilliseconds(2_000));
+    }
+
+    /// <summary>A positive <c>TimeoutMs</c> is honoured verbatim.</summary>
+    [Fact]
+    public void ParseOptions_honours_a_positive_TimeoutMs()
+    {
+        var opts = AbCipDriverFactoryExtensions.ParseOptions("drv-1", """{"TimeoutMs":500}""");
+        opts.Timeout.ShouldBe(TimeSpan.FromMilliseconds(500));
+    }
+
     /// <summary>A driver-config tag declaring isArray/elementCount produces an array definition.</summary>
     [Fact]
     public void ParseOptions_threads_isArray_and_elementCount_into_tag_definition()