fix(archreview #10): wire CapabilityInvoker into prod dispatch via a Polly-free seam

Remediates RESILIENCE-DISPATCH-GAP (surfaced by the 07/C-1 analyzer): the Phase 6.1
CapabilityInvoker resilience pipeline (retry / breaker / bulkhead / telemetry) was
constructed only in tests — the production dispatch layer called driver-capability
methods directly, bypassing it entirely.

The filed plan (thread CapabilityInvoker directly into DriverInstanceActor) is
INFEASIBLE: Runtime is deliberately Polly-free (references Core.Abstractions, not
Core — the same boundary IDriverFactory documents). So this introduces a seam,
mirroring IDriverFactory exactly:

- Core.Abstractions: IDriverCapabilityInvoker (+ NullDriverCapabilityInvoker
  pass-through) and IDriverCapabilityInvokerFactory (+ null factory).
- Core: CapabilityInvoker now implements the interface; new
  DriverCapabilityInvokerFactory builds a per-instance invoker over the
  process-singleton pipeline builder + status tracker + tier resolver.
- Runtime: DriverInstanceActor takes an IDriverCapabilityInvoker (default =
  pass-through) and routes all 6 dispatch sites (write, alarm-ack, subscribe,
  unsubscribe, alarm-subscribe, discover) through it; per-host key resolved via
  IPerCallHostResolver for single-ref calls, driver-instance key for bulk calls.
  DriverHostActor builds + injects the real invoker per spawned driver.
- Host: DriverFactoryBootstrap registers the tracker, pipeline builder, and
  concrete factory (needs DriverFactoryRegistry.GetTier). Runtime SCE resolves the
  factory from DI like IDriverFactory; pass-through on nodes without it bound.
- Analyzer: IDriverCapabilityInvoker.ExecuteAsync/ExecuteWriteAsync are now
  recognized wrapper homes (interface-typed invoker calls must suppress OTOPCUA0001
  too). All 6 RESILIENCE-DISPATCH-GAP pragmas removed — the analyzer (an error in
  Runtime) is now the standing regression guard.

Also adds retry / breaker-open / breaker-close LOGGING to the pipeline builder —
the operator-facing observability surface (the Admin /hosts reader, Phase 6.1
Stream E.2/E.3, was never built, so the pipeline otherwise runs silently).

Scope notes:
- Tier-DEFAULT policy only: DriverInstanceSpec (the deploy artifact) does not carry
  the per-instance ResilienceConfig JSON, so overrides aren't applied yet (tracked
  follow-up: plumb ResilienceConfig through the composer/artifact).
- GenericDriverNodeManager's call is NOT wired: that class is test-only scaffolding
  (zero production references — the Server has its own address-space path); its
  pragma is re-annotated accordingly, not left as a "tracked gap".

Verification (unit + analyzer; live behavioral gate still pending — see FOLLOWUP-10):
- Negative control: unwrapping any site fails the Runtime build with OTOPCUA0001.
- New Runtime guard (recording invoker): write routes via ExecuteWriteAsync with the
  IPerCallHostResolver host; subscribe via ExecuteAsync — proves runtime routing.
- New analyzer test: the interface is a valid wrapper home.
- New pipeline-builder test: retry events are logged.
- Full solution builds clean (0 errors); Runtime.Tests 357, Core.Tests 238,
  Analyzers.Tests 32 all green; pass-through default keeps existing dispatch tests
  byte-for-byte unchanged.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IDriverCapabilityInvokerFactory.cs

@@ -0,0 +1,39 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Builds a per-driver-instance <see cref="IDriverCapabilityInvoker"/>. The Runtime
+///     <c>DriverHostActor</c> consumes this factory (resolved from DI, like <see cref="IDriverFactory"/>)
+///     to attach a resilience invoker to each spawned <c>DriverInstanceActor</c> WITHOUT the actor
+///     assembly referencing <c>ZB.MOM.WW.OtOpcUa.Core</c> (which drags in Polly). The fused Host
+///     binds a concrete factory closing over the process-singleton pipeline builder + status tracker +
+///     driver-tier resolver; when unbound, <see cref="NullDriverCapabilityInvokerFactory"/> yields the
+///     pass-through invoker so dispatch behaves exactly as before.
+/// </summary>
+public interface IDriverCapabilityInvokerFactory
+{
+    /// <summary>
+    ///     Create the resilience invoker for one driver instance. The returned invoker is keyed on
+    ///     <paramref name="driverInstanceId"/> and applies the tier policy resolved from
+    ///     <paramref name="driverType"/>.
+    /// </summary>
+    /// <param name="driverInstanceId">The driver instance identifier (pipeline + tracker key).</param>
+    /// <param name="driverType">The driver type name, used to resolve the resilience tier defaults.</param>
+    /// <returns>A per-instance <see cref="IDriverCapabilityInvoker"/>.</returns>
+    IDriverCapabilityInvoker Create(string driverInstanceId, string driverType);
+}
+
+/// <summary>
+///     Returns <see cref="NullDriverCapabilityInvoker.Instance"/> for every driver instance. Bound
+///     when the fused Host hasn't registered a real resilience factory (Mac dev path, smoke tests,
+///     admin-only nodes). Dispatch then routes calls straight through with no pipeline.
+/// </summary>
+public sealed class NullDriverCapabilityInvokerFactory : IDriverCapabilityInvokerFactory
+{
+    /// <summary>The shared singleton instance.</summary>
+    public static readonly NullDriverCapabilityInvokerFactory Instance = new();
+    private NullDriverCapabilityInvokerFactory() { }
+
+    /// <inheritdoc />
+    public IDriverCapabilityInvoker Create(string driverInstanceId, string driverType) =>
+        NullDriverCapabilityInvoker.Instance;
+}