Task #250 — AB CIP + AB Legacy test-client CLIs

Second + third of the four driver test clients. Both follow the same shape as
otopcua-modbus-cli (#249) and consume Driver.Cli.Common for DriverCommandBase +
SnapshotFormatter.

New projects:
  - src/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/ — otopcua-abcip-cli.
    AbCipCommandBase carries gateway (ab://host[:port]/cip-path) + family
    (ControlLogix/CompactLogix/Micro800/GuardLogix) + timeout.
    Commands: probe, read, write, subscribe.
    Value parser covers every AbCipDataType atomic type (Bool, SInt..LInt,
    USInt..ULInt, Real, LReal, String, Dt); Structure writes refused as
    out-of-scope for the CLI.
  - src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/ — otopcua-ablegacy-cli.
    AbLegacyCommandBase carries gateway + plc-type (Slc500/MicroLogix/Plc5/
    LogixPccc) + timeout.
    Commands: probe (default address N7:0), read, write, subscribe.
    Value parser covers Bit, Int, Long, Float, AnalogInt, String, and the
    three sub-element types (TimerElement / CounterElement / ControlElement
    all land on int32 at the wire).

Tests (35 new, 73 cumulative across the driver CLI family):
  - AB CIP: 17 tests — ParseValue happy-paths for every Logix atomic type,
    failure cases (non-numeric / bool garbage), tag-name synthesis.
  - AB Legacy: 18 tests — ParseValue coverage (Bit / Int / AnalogInt / Long /
    Float / String / sub-elements), PCCC address round-trip in tag names
    including bit-within-word + sub-element syntax.

Docs:
  - docs/Driver.AbCip.Cli.md — family ↔ CIP-path cheat sheet + examples per
    command + typical workflows.
  - docs/Driver.AbLegacy.Cli.md — PCCC address primer (file letters → CLI
    --type) + known ab_server upstream gap cross-ref to #224 close-out.

Wiring:
  - ZB.MOM.WW.OtOpcUa.slnx grew 4 entries (2 src + 2 tests).

Full-solution build clean. `otopcua-abcip-cli --help` + `otopcua-ablegacy-cli
--help` verified end-to-end.

Next up (#251): S7 + TwinCAT CLIs, same pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/Driver.AbCip.Cli.md

@@ -0,0 +1,83 @@
+# `otopcua-abcip-cli` — AB CIP test client
+
+Ad-hoc probe / read / write / subscribe tool for ControlLogix / CompactLogix /
+Micro800 / GuardLogix PLCs, talking to the **same** `AbCipDriver` the OtOpcUa
+server uses (libplctag under the hood).
+
+Second of four driver test-client CLIs (Modbus → AB CIP → AB Legacy → S7 →
+TwinCAT). Shares `Driver.Cli.Common` with the others.
+
+## Build + run
+
+```powershell
+dotnet run --project src/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli -- --help
+```
+
+## Common flags
+
+| Flag | Default | Purpose |
+|---|---|---|
+| `-g` / `--gateway` | **required** | Canonical `ab://host[:port]/cip-path` |
+| `-f` / `--family` | `ControlLogix` | ControlLogix / CompactLogix / Micro800 / GuardLogix |
+| `--timeout-ms` | `5000` | Per-operation timeout |
+| `--verbose` | off | Serilog debug output |
+
+Family ↔ CIP-path cheat sheet:
+- **ControlLogix / CompactLogix / GuardLogix** — `1,0` (slot 0 of chassis)
+- **Micro800** — empty path, just `ab://host/`
+- **Sub-slot Logix** (rare) — `1,3` for slot 3
+
+## Commands
+
+### `probe` — is the PLC up?
+
+```powershell
+# ControlLogix — read the canonical libplctag system tag
+otopcua-abcip-cli probe -g ab://10.0.0.5/1,0 -t @raw_cpu_type --type DInt
+
+# Micro800 — point at a user-supplied global
+otopcua-abcip-cli probe -g ab://10.0.0.6/ -f Micro800 -t _SYSVA_CLOCK_HOUR --type DInt
+```
+
+### `read` — single Logix tag
+
+```powershell
+# Controller scope
+otopcua-abcip-cli read -g ab://10.0.0.5/1,0 -t Motor01_Speed --type Real
+
+# Program scope
+otopcua-abcip-cli read -g ab://10.0.0.5/1,0 -t "Program:Main.Counter" --type DInt
+
+# Array element
+otopcua-abcip-cli read -g ab://10.0.0.5/1,0 -t "Recipe[3]" --type Real
+
+# UDT member (dotted path)
+otopcua-abcip-cli read -g ab://10.0.0.5/1,0 -t "Motor01.Speed" --type Real
+```
+
+### `write` — single Logix tag
+
+Same shape as `read` plus `-v`. Values parse per `--type` using invariant
+culture. Booleans accept `true`/`false`/`1`/`0`/`yes`/`no`/`on`/`off`.
+Structure (UDT) writes need the member layout declared in a real driver config
+and are refused by the CLI.
+
+```powershell
+otopcua-abcip-cli write -g ab://10.0.0.5/1,0 -t Motor01_Speed --type Real -v 3.14
+otopcua-abcip-cli write -g ab://10.0.0.5/1,0 -t StartCommand --type Bool -v true
+```
+
+### `subscribe` — watch a tag until Ctrl+C
+
+```powershell
+otopcua-abcip-cli subscribe -g ab://10.0.0.5/1,0 -t Motor01_Speed --type Real -i 500
+```
+
+## Typical workflows
+
+- **"Is the PLC reachable?"** → `probe`.
+- **"Did my recipe write land?"** → `write` + `read` back.
+- **"Why is tag X flipping?"** → `subscribe`.
+- **"Is this GuardLogix safety tag writable from non-safety?"** → `write` and
+  read the status code — safety tags surface `BadNotWritable` / CIP errors,
+  non-safety tags surface `Good`.