test(ab-transport): non-zero array/BOOL captures, committed capture client, sim quirks

Review round 1 on the golden frames:
- Re-captured logix-read-dint-array16 (element i = ((i+1)<<24)|(i+1)) and
  logix-read-bool (= 1) so neither decode oracle is all zeros. ab_server rejects
  libplctag's own BOOL write with CIP 0x03 (two data bytes for a one-byte BOOL),
  so the BOOL is seeded by a raw UCMM Write Tag (client seed-bool).
- Committed the capture client as scripts/ab-capture/client (outside the slnx,
  CPM off, libplctag 1.5.2 pinned); capture.sh gains a `client` subcommand.
- README documents simulator-only behaviour: zeroed reply sender context, STRING
  typed D0 00 instead of A0 02 + handle, and the BOOL write refusal.
- capture.sh no longer claims UnregisterSession reaches the wire (session ends in RST).
- CaptureFileTests also check the CPF walk ends at the frame end and that every
  reply service is its request service | 0x80.

scripts/ab-capture/capture.sh

@@ -20,12 +20,17 @@
 # Usage:
 #   CAPDIR=<fresh empty dir> scripts/ab-capture/capture.sh run <container> <name> -- <client command...>
 #   scripts/ab-capture/capture.sh tohex <pcap> <out.hex>
+#   scripts/ab-capture/capture.sh client <client args...>
 #
-# The client command is whatever drives libplctag; the session used for the
-# committed fixtures is a ~60-line console program over libplctag 1.5.2 (one tag,
-# one Initialize + Read/Write, then Dispose + plc_tag_shutdown so the Forward Close
-# and Unregister Session reach the wire). See Captures/README.md for every
-# invocation.
+# `client` builds (once) and runs scripts/ab-capture/client — the console program
+# over libplctag 1.5.2 that took the committed fixtures: one tag, one Initialize +
+# Read/Write, then Dispose + plc_tag_shutdown so the Forward Close reaches the wire.
+# No UnregisterSession is ever sent; the session ends with a TCP RST. Example:
+#
+#   CAPDIR=$PWD/caps scripts/ab-capture/capture.sh run otopcua-ab-server-controllogix logix-read-dint -- \
+#       scripts/ab-capture/capture.sh client read 10.100.0.35:44818 1,0 ControlLogix TestDINT dint
+#
+# See Captures/README.md for every invocation used.
 #
 # Fixtures (one AbCip profile at a time — they all bind host :44818):
 #   ssh dohertj2@10.100.0.35 'cd /opt/otopcua-abcip && docker compose --profile controllogix up -d'
@@ -39,6 +44,13 @@ REMOTE_DIR="${REMOTE_DIR:-/tmp/abcap}"
 cmd="${1:-}"; shift || true
 
 case "$cmd" in
+  client)
+    here="$(cd "$(dirname "$0")" && pwd)"
+    dll="$here/client/bin/Release/net10.0/ab-capture-client.dll"
+    [[ -f "$dll" ]] || dotnet build "$here/client/ab-capture-client.csproj" -c Release -v q >&2
+    exec dotnet "$dll" "$@"
+    ;;
+
   run)
     container="$1"; name="$2"; shift 2
     [[ "${1:-}" == "--" ]] && shift
@@ -92,5 +104,5 @@ for k, rest in bufs.items():
     ;;
 
   *)
-    sed -n '2,32p' "$0"; exit 2 ;;
+    sed -n '2,37p' "$0"; exit 2 ;;
 esac