feat(mesh-phase4): driver-only node must be FetchAndCache (validator)

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/ConfigSourceOptionsValidatorTests.cs

@@ -1,3 +1,4 @@
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Options;
 using Shouldly;
 using Xunit;
@@ -11,8 +12,18 @@ namespace ZB.MOM.WW.OtOpcUa.Cluster.Tests;
 /// </summary>
 public class ConfigSourceOptionsValidatorTests
 {
-    private static ValidateOptionsResult Validate(ConfigSourceOptions o) =>
-        new ConfigSourceOptionsValidator().Validate(ConfigSourceOptions.SectionName, o);
+    private static ValidateOptionsResult Validate(ConfigSourceOptions o, params string[] roles)
+    {
+        var pairs = new Dictionary<string, string?>();
+        for (var i = 0; i < roles.Length; i++)
+        {
+            pairs[$"Cluster:Roles:{i}"] = roles[i];
+        }
+
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(pairs).Build();
+
+        return new ConfigSourceOptionsValidator(configuration).Validate(ConfigSourceOptions.SectionName, o);
+    }
 
     private static ConfigSourceOptions ValidFetch() => new()
     {
@@ -117,4 +128,41 @@ public class ConfigSourceOptionsValidatorTests
             FetchTimeoutSeconds = 0,
         }).Succeeded.ShouldBeTrue();
     }
+
+    [Fact]
+    public void Driver_only_node_on_Direct_fails()
+    {
+        // A driver-only node has no central ConfigDb connection (Phase 4) — Direct silently produces a
+        // node that can never read its configuration.
+        var result = Validate(
+            new ConfigSourceOptions { Mode = ConfigSourceOptions.ModeDirect },
+            "driver");
+
+        result.Failed.ShouldBeTrue();
+        result.FailureMessage.ShouldContain(ConfigSourceOptions.ModeFetchAndCache);
+    }
+
+    [Fact]
+    public void Fused_admin_and_driver_node_on_Direct_is_valid()
+    {
+        // A fused node holds the ConfigDb connection via its admin role, so Direct is still legitimate.
+        Validate(
+            new ConfigSourceOptions { Mode = ConfigSourceOptions.ModeDirect },
+            "admin", "driver").Succeeded.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Driver_only_node_on_FetchAndCache_is_valid()
+    {
+        Validate(ValidFetch(), "driver").Succeeded.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Admin_only_node_on_Direct_is_valid()
+    {
+        // An admin-only node has no driver role at all, so the driver-only rule does not apply to it.
+        Validate(
+            new ConfigSourceOptions { Mode = ConfigSourceOptions.ModeDirect },
+            "admin").Succeeded.ShouldBeTrue();
+    }
 }