test(infra): port-NAT opc-plc fixture for the NAT browse tests; wire OPCUA_NAT_ENDPOINT into CI (#813)

Docker/nat/docker-compose.yml (stack /opt/otopcua-opcuaclient-nat on 10.100.0.35,
project: lmxopcua label): opc-plc 2.14.10 advertising --ph=otopcua-opc-plc-nat-private.invalid
on internal 50000, published on 50010, so every advertised URL is unreachable on host AND
port. Deployed; NatPublishedEndpointBrowseTests 3/3 against opc.tcp://10.100.0.35:50010
(and the secure case positive once, with the fixture cert temporarily trusted).

CI: integration-fixtures.sh starts a throwaway otopcua-ci-opcplc-nat (50110->50000) and
exports OPCUA_NAT_ENDPOINT; v2-e2e.yml points it at the shared stack. infra/README.md,
scripts/ci/README.md and the fixture README document it.

.github/workflows/v2-e2e.yml

@@ -49,6 +49,9 @@ jobs:
         env:
           E2E_PROJECTS: >-
             Driver.Modbus Driver.S7 Driver.OpcUaClient Driver.OpcUaClient.Browser
+          # #813: the port-NAT opc-plc stack (/opt/otopcua-opcuaclient-nat). Not in the probe's required ports —
+          # NatPublishedEndpointBrowseTests TCP-probe it themselves and skip if it is down.
+          OPCUA_NAT_ENDPOINT: opc.tcp://10.100.0.35:50010
         run: |
           set -euo pipefail
           for p in $E2E_PROJECTS; do