feat(abcip): final review I1 — node-level Drivers:AbCip:DefaultTransport

The old AdminUI cannot author the per-driver transport key (#576), so the
'pin before upgrading' recipe had no working path. A node-level appsetting
(env Drivers__AbCip__DefaultTransport) now supplies the default for AbCip
drivers with no key: explicit key > node default > compiled Native. Bound
and validated unconditionally (bad value fails host start); the driver
factory and the Test Connect probe both read it so they agree. AbCip.md
upgrade recipe rewritten around the key; Configuration.md documents it.
Also documents first-wins for AllowPacking/probe and host-alias throttles
(final review M6) and moves the status-bit note out of AbCip.md (M5).

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -175,6 +175,13 @@ builder.Services.AddOtOpcUaCluster(builder.Configuration);
 // the startup check (AddOtOpcUaAuth binds LdapOptions but does not attach a validator).
 builder.Services.AddValidatedOptions<LdapOptions, LdapOptionsValidator>(builder.Configuration, LdapOptions.SectionName);
 
+// Node-level AbCip default transport (final review I1): the transport an AbCip driver with NO "transport"
+// key runs on. Unconditional because BOTH consumers need it — the driver factory (driver role) and the
+// Test Connect probe (admin role, which must probe the stack the driver would run). A bad value fails host
+// start here rather than silently falling back.
+builder.Services.AddValidatedOptions<AbCipDriverDefaultsOptions, AbCipDriverDefaultsOptionsValidator>(
+    builder.Configuration, AbCipDriverDefaultsOptions.SectionName);
+
 if (hasDriver)
 {
     builder.Services.AddOtOpcUaRuntime();