Task #253 follow-up — bidirectional + subscribe-sees-change e2e stages

The original three-stage design (probe / driver-loopback / forward-
bridge) only proved driver-write → server-read. It missed:

 - OPC UA write → server → driver → PLC (the reverse direction)
 - server-side data-change notifications actually firing (a stale
   subscription can still let a read-after-the-fact return the new
   value and look fine)

Extend _common.ps1 with two helpers:

 - Test-OpcUaWriteBridge: otopcua-cli write the NodeId -> wait 3s ->
   driver CLI read the PLC side, assert equality.
 - Test-SubscribeSeesChange: Start-Process otopcua-cli subscribe in the
   background with --duration N, settle 2s, driver-side write, wait for
   the subscription window to close, assert captured stdout contains
   the new value.

Wire both into test-modbus / test-abcip / test-ablegacy / test-s7 /
test-focas / test-twincat after the existing forward-bridge stage.
Update README to describe the five-stage design + note that the
published NodeId must be writable for stages 4 + 5.

Also prepend UTF-8 BOM to every script in scripts/e2e so Windows
PowerShell 5.1 parsers agree on em-dash byte sequences the way
PowerShell 7 already does. The scripts still #Requires -Version 7.0 —
the BOM is purely defensive for IDE / CI step parsers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/e2e/test-modbus.ps1

@@ -1,13 +1,15 @@
-#Requires -Version 7.0
+#Requires -Version 7.0
 <#
 .SYNOPSIS
   End-to-end CLI test for the Modbus-TCP driver bridged through the OtOpcUa server.
 
 .DESCRIPTION
-  Three assertions:
+  Five assertions:
     1. `otopcua-modbus-cli probe` hits the simulator
     2. Driver-loopback write + read-back via modbus-cli
-    3. Bridge: modbus-cli writes HR[100], OPC UA client reads the bridged NodeId
+    3. Forward bridge: modbus-cli writes HR[100], OPC UA client reads the bridged NodeId
+    4. Reverse bridge: OPC UA client writes the NodeId, modbus-cli reads HR[100]
+    5. Subscribe-sees-change: OPC UA subscription observes a modbus-cli write
 
   Requires a running Modbus simulator on localhost:5502 (the pymodbus fixture
   default per docs/drivers/Modbus-Test-Fixture.md) and a running OtOpcUa server
@@ -70,5 +72,23 @@ $results += Test-ServerBridge `
     -OpcUaNodeId $BridgeNodeId `
     -ExpectedValue "$bridgeValue"
 
+$reverseValue = Get-Random -Minimum 20000 -Maximum 29999
+$results += Test-OpcUaWriteBridge `
+    -OpcUaCli $opcUaCli `
+    -OpcUaUrl $OpcUaUrl `
+    -OpcUaNodeId $BridgeNodeId `
+    -DriverCli $modbusCli `
+    -DriverReadArgs (@("read") + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16")) `
+    -ExpectedValue "$reverseValue"
+
+$subValue = Get-Random -Minimum 30000 -Maximum 39999
+$results += Test-SubscribeSeesChange `
+    -OpcUaCli $opcUaCli `
+    -OpcUaUrl $OpcUaUrl `
+    -OpcUaNodeId $BridgeNodeId `
+    -DriverCli $modbusCli `
+    -DriverWriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16", "-v", $subValue)) `
+    -ExpectedValue "$subValue"
+
 Write-Summary -Title "Modbus e2e" -Results $results
 if ($results | Where-Object { -not $_.Passed }) { exit 1 }