fix(opcuaclient): writes feed health; a good keep-alive clears a stale Degraded

Health contract: a write response (per-node refusals included) is the server
answering, so it restores Healthy and advances LastSuccessfulRead; a write with no
reply (transport failure / timeout) writes Degraded with the stamp preserved; a
caller-cancelled write touches nothing. A good keep-alive with no outage or dead
subscription latched now clears a Degraded left by a failed read/write instead of
only moving the stamp (a subscription-only driver otherwise stayed Degraded until
its next re-initialise). All writes are generation-stamped.

Refs #743

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

docs/drivers/OpcUaClient.md

@@ -91,6 +91,11 @@ The session keep-alive (`KeepAliveInterval`, default 5 s) is the liveness signal
 
 - **Good keep-alive / any data or event notification** advances `DriverHealth.LastSuccessfulRead` — a
   subscription-only driver never calls `ReadAsync`, so without this its read stamp froze at connect time.
+  A good keep-alive with no outage latched also **clears a `Degraded` left by a failed read/write** (it used to move
+  only the stamp, so a subscription-only driver stayed `Degraded` until its next re-initialise).
+- **Read / write / ack responses are replies.** Any service response — per-node refusals such as `BadNotWritable`
+  included — restores `Healthy` and advances the stamp; only a call that got **no** response (transport failure,
+  timeout) writes `Degraded` with the stamp preserved. A write the caller cancelled touches no health.
 - **Bad keep-alive** ⇒ health `Degraded` (`LastError = "keep-alive: <status>"`, read stamp preserved), host status
   `Stopped`, and — **once per outage**, not per keep-alive — every subscribed ref is published `BadNoCommunication`
   with its last value retained and **source + server timestamp = the detection time** (live-gate F1: stamped with the