test(validation): #800 Windows service gate harness + windev results (SDK 1.5 -> 2.0.1 in place, rollback)

Adds scripts/validation/opcua-windows-service/: a phased PowerShell gate (Invoke-ServiceGate.ps1)
that installs the known-good build as the real OtOpcUaHost service via Install-Services.ps1, seeds
LocalDb through the production cache API (Seeder, built against the baseline tree), upgrades in
place with config/PKI/LocalDb carried with their ACLs, starts/stops through the SCM, runs a strict
SDK 2 probe matrix (Sign + SignAndEncrypt, valid/wrong/unknown/disabled/anonymous keys, untrusted
client and server), exercises the ScriptWorker isolation, rolls back and cleans up.

windev 2026-11-12 (efb9197a -> 438484fd -> efb9197a): app cert CEF9D91F... reused byte-for-byte
with identical PKI SDDL on every start, all gating checks pass, 0 secrets in logs. Findings filed:
#879 (None endpoint cannot be dropped), #880 (SDK 2 client 65-char key vs SDK 1.5 server:
rollback/QA risk), #883 (Install-ScriptWorkerIsolation.ps1 fails on pwsh 7 and 5.1; runtime
isolation proven with the patch in the evidence directory).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

scripts/validation/opcua-windows-service/BindRepro/Program.cs

@@ -0,0 +1,11 @@
+using Microsoft.Extensions.Configuration;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+// The documented hardening (docs/security.md): list only the secure profiles.
+var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
+{
+    ["OpcUa:EnabledSecurityProfiles:0"] = "Basic256Sha256Sign",
+    ["OpcUa:EnabledSecurityProfiles:1"] = "Basic256Sha256SignAndEncrypt",
+}).Build();
+var options = new OpcUaApplicationHostOptions();
+config.GetSection("OpcUa").Bind(options);
+Console.WriteLine(string.Join(", ", options.EnabledSecurityProfiles));