Task #253 follow-up — bidirectional + subscribe-sees-change e2e stages

The original three-stage design (probe / driver-loopback / forward-
bridge) only proved driver-write → server-read. It missed:

 - OPC UA write → server → driver → PLC (the reverse direction)
 - server-side data-change notifications actually firing (a stale
   subscription can still let a read-after-the-fact return the new
   value and look fine)

Extend _common.ps1 with two helpers:

 - Test-OpcUaWriteBridge: otopcua-cli write the NodeId -> wait 3s ->
   driver CLI read the PLC side, assert equality.
 - Test-SubscribeSeesChange: Start-Process otopcua-cli subscribe in the
   background with --duration N, settle 2s, driver-side write, wait for
   the subscription window to close, assert captured stdout contains
   the new value.

Wire both into test-modbus / test-abcip / test-ablegacy / test-s7 /
test-focas / test-twincat after the existing forward-bridge stage.
Update README to describe the five-stage design + note that the
published NodeId must be writable for stages 4 + 5.

Also prepend UTF-8 BOM to every script in scripts/e2e so Windows
PowerShell 5.1 parsers agree on em-dash byte sequences the way
PowerShell 7 already does. The scripts still #Requires -Version 7.0 —
the BOM is purely defensive for IDE / CI step parsers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/e2e/test-s7.ps1

@@ -1,12 +1,12 @@
-#Requires -Version 7.0
+#Requires -Version 7.0
 <#
 .SYNOPSIS
   End-to-end CLI test for the Siemens S7 driver bridged through the OtOpcUa server.
 
 .DESCRIPTION
-  Probe + driver-loopback + server-bridge against a Siemens S7-300/400/1200/1500
-  or compatible soft-PLC. python-snap7 simulator (task #216) or real hardware
-  both work.
+  Five assertions (probe / driver-loopback / forward-bridge / reverse-bridge /
+  subscribe-sees-change) against a Siemens S7-300/400/1200/1500 or compatible
+  soft-PLC. python-snap7 simulator (task #216) or real hardware both work.
 
   Prereqs:
     - S7 simulator / PLC on $S7Host:$S7Port
@@ -78,5 +78,23 @@ $results += Test-ServerBridge `
     -OpcUaNodeId $BridgeNodeId `
     -ExpectedValue "$bridgeValue"
 
+$reverseValue = Get-Random -Minimum 20000 -Maximum 29999
+$results += Test-OpcUaWriteBridge `
+    -OpcUaCli $opcUaCli `
+    -OpcUaUrl $OpcUaUrl `
+    -OpcUaNodeId $BridgeNodeId `
+    -DriverCli $s7Cli `
+    -DriverReadArgs (@("read") + $commonS7 + @("-a", $Address, "-t", "Int16")) `
+    -ExpectedValue "$reverseValue"
+
+$subValue = Get-Random -Minimum 30000 -Maximum 32766
+$results += Test-SubscribeSeesChange `
+    -OpcUaCli $opcUaCli `
+    -OpcUaUrl $OpcUaUrl `
+    -OpcUaNodeId $BridgeNodeId `
+    -DriverCli $s7Cli `
+    -DriverWriteArgs (@("write") + $commonS7 + @("-a", $Address, "-t", "Int16", "-v", $subValue)) `
+    -ExpectedValue "$subValue"
+
 Write-Summary -Title "S7 e2e" -Results $results
 if ($results | Where-Object { -not $_.Passed }) { exit 1 }