test(infra): port-NAT opc-plc fixture for the NAT browse tests; wire OPCUA_NAT_ENDPOINT into CI (#813)

Docker/nat/docker-compose.yml (stack /opt/otopcua-opcuaclient-nat on 10.100.0.35,
project: lmxopcua label): opc-plc 2.14.10 advertising --ph=otopcua-opc-plc-nat-private.invalid
on internal 50000, published on 50010, so every advertised URL is unreachable on host AND
port. Deployed; NatPublishedEndpointBrowseTests 3/3 against opc.tcp://10.100.0.35:50010
(and the secure case positive once, with the fixture cert temporarily trusted).

CI: integration-fixtures.sh starts a throwaway otopcua-ci-opcplc-nat (50110->50000) and
exports OPCUA_NAT_ENDPOINT; v2-e2e.yml points it at the shared stack. infra/README.md,
scripts/ci/README.md and the fixture README document it.

scripts/ci/README.md

@@ -67,7 +67,8 @@ Neither touches `v2-ci.yml`; each has its own concurrency group (`lmxopcua-v2-in
 
 - **`v2-integration.yml`** (push to `master`, path-filtered PRs, manual; `timeout-minutes: 60`).
   `integration-fixtures.sh up` starts throwaway SQL Server 2022, PostgreSQL 17 (seeded from `seed-pg.sql`),
-  QuestDB and opc-plc (`otopcua-ci-*`, non-default host ports), exports the env vars the fixtures read, and
+  QuestDB and opc-plc — plus a port-NAT opc-plc (`otopcua-ci-opcplc-nat`, host 50110 → 50000, private `.invalid`
+  advertised host, `OPCUA_NAT_ENDPOINT`, #813) — (`otopcua-ci-*`, non-default host ports), exports the env vars the fixtures read, and
   `down` removes them. It uses plain `docker run`, not `services:` (act_runner support is undocumented and
   Postgres needs a seed step); the only runner requirement is a docker daemon. Runs the Sql, Historian.SqlServer,
   Historian.QuestDb, OpcUaClient and OpcUaClient.Browser `*.IntegrationTests` with `MIN_EXECUTED=440`.
@@ -77,5 +78,6 @@ Neither touches `v2-ci.yml`; each has its own concurrency group (`lmxopcua-v2-in
 - **`v2-e2e.yml`** (manual + weekly cron only; `timeout-minutes: 90`). `probe-e2e-fixtures.sh` TCP-probes
   10.100.0.35 ports 5020/1102/50000; if any is closed every later step is skipped and the run is green with a
   notice. Otherwise runs the Modbus, S7, OpcUaClient and OpcUaClient.Browser integration projects against the
-  shared fleet with `MIN_EXECUTED=35` (local: 42 executed / 38 skipped; Modbus skips the profiles that are not
+  shared fleet with `MIN_EXECUTED=35` (`OPCUA_NAT_ENDPOINT` points at the shared NAT stack on :50010; its 3 tests
+  skip if it is down, so it is not a probe-required port) (local: 42 executed / 38 skipped; Modbus skips the profiles that are not
   up). No test carries `Category=E2E` today, so the zero-match guard is this executed floor.

scripts/ci/integration-fixtures.sh

@@ -2,7 +2,7 @@
 #
 # integration-fixtures.sh — throwaway, self-contained fixtures for the v2-integration workflow (#757).
 #
-#   up    start SQL Server, PostgreSQL (seeded), QuestDB and opc-plc as containers named
+#   up    start SQL Server, PostgreSQL (seeded), QuestDB, opc-plc and a port-NAT opc-plc as containers named
 #         otopcua-ci-*, wait until each is usable, and print the env exports the
 #         *.IntegrationTests fixtures read (also appended to $GITHUB_ENV when set).
 #   down  remove those containers (idempotent; touches nothing else).
@@ -21,10 +21,13 @@ PG_PORT="${CI_PG_PORT:-15440}"
 QDB_PORT="${CI_QDB_PORT:-18812}"
 QDB_HTTP_PORT="${CI_QDB_HTTP_PORT:-19000}"
 OPC_PORT="${CI_OPC_PORT:-50100}"
+# #813 NAT opc-plc: published on OPC_NAT_PORT, listening on 50000 inside, advertising a private `.invalid`
+# host — so its GetEndpoints URLs are unreachable on BOTH host and port (NatPublishedEndpointBrowseTests).
+OPC_NAT_PORT="${CI_OPC_NAT_PORT:-50110}"
 # Throwaway-container-only credentials (never used against anything else).
 SA_PASSWORD="${CI_SA_PASSWORD:-Ci_throwaway_Pw1}"
 PG_PASSWORD="${CI_PG_PASSWORD:-Ci_throwaway_pg1}"
-NAMES=(otopcua-ci-mssql otopcua-ci-pg otopcua-ci-questdb otopcua-ci-opcplc)
+NAMES=(otopcua-ci-mssql otopcua-ci-pg otopcua-ci-questdb otopcua-ci-opcplc otopcua-ci-opcplc-nat)
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 
 fixture_host() {
@@ -59,6 +62,9 @@ up() {
     questdb/questdb:10.0.1 >/dev/null
   docker run -d --name otopcua-ci-opcplc -p "$OPC_PORT:$OPC_PORT" \
     mcr.microsoft.com/iotedge/opc-plc:2.14.10 --pn="$OPC_PORT" --ut --aa --alm >/dev/null
+  # Mirrors tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/nat/docker-compose.yml.
+  docker run -d --name otopcua-ci-opcplc-nat --hostname otopcua-ci-opcplc-nat-private -p "$OPC_NAT_PORT:50000" \
+    mcr.microsoft.com/iotedge/opc-plc:2.14.10 --pn=50000 --ph=otopcua-ci-opcplc-nat-private.invalid --ut --aa >/dev/null
 
   wait_for "postgres" 120 docker exec otopcua-ci-pg pg_isready -U postgres -d sqlpollfixture
   # pg_isready can answer during initdb's temp server; require a real query on the final server.
@@ -73,6 +79,7 @@ up() {
   wait_for "sql server" 300 docker exec otopcua-ci-mssql "$sqlcmd" -C -S localhost -U sa -P "$SA_PASSWORD" -Q 'SELECT 1'
   wait_for "questdb" 120 curl -fsS "http://$(fixture_host):$QDB_HTTP_PORT/exec?query=select%201"
   wait_for "opc-plc" 120 bash -c "exec 3<>/dev/tcp/$(fixture_host)/$OPC_PORT"
+  wait_for "opc-plc (NAT)" 120 bash -c "exec 3<>/dev/tcp/$(fixture_host)/$OPC_NAT_PORT"
 
   local h; h="$(fixture_host)"
   local -a exports=(
@@ -84,6 +91,7 @@ up() {
     "HISTORIAN_SQL_TEST_CONNECTION=Server=$h,$SQL_PORT;User Id=sa;Password=$SA_PASSWORD;TrustServerCertificate=True;Encrypt=False"
     "HISTORIAN_QUESTDB_TEST_CONNECTION=Host=$h;Port=$QDB_PORT;Username=admin;Password=quest;Database=qdb;ServerCompatibilityMode=NoTypeLoading"
     "OPCUA_SIM_ENDPOINT=opc.tcp://$h:$OPC_PORT"
+    "OPCUA_NAT_ENDPOINT=opc.tcp://$h:$OPC_NAT_PORT"
   )
   for e in "${exports[@]}"; do
     echo "export \"$e\""