fix(address-space): exact element-type check for array writes + array-capability shape edges (#610 review R4)

MAJOR-1: the SDK skips TypeInfo.IsInstanceOfDataType on any node with an
OnWriteValue handler (every writable equipment node), and the node manager's
fail-fast treated numeric<->numeric as compatible, so a UInt32[] to a Galaxy
Int32 array matched MxValueEncoder's int[] arm by CLR covariance and was
written bit-reinterpreted with a Good result. EvaluateEquipmentWriteStructure
now matches an ARRAY write's element type exactly (Byte[]/ByteString the only
equivalence; Variant[]/object[] refused) -> BadTypeMismatch, nothing
dispatched. MxValueEncoder's int[]/long[] arms are exact-type guarded too, and
the Galaxy parity test's false "the SDK refuses" premise is corrected (the
UInt32/UInt64 exclusion is now the encoder's own answer). Scalar writes keep
numeric widening by decision: consumers write CLR-typed values (Double to a
Float node) and every driver's scalar encoder range-checks.

MINOR: Modbus row honours maxRegistersPerWrite (smallest of DriverConfig /
the tag's DeviceConfig, default 123) and FC15's 1968-coil ceiling, and
requires region + numeric address; Modbus/S7/Galaxy require isArray + integer
arrayLength >= 1 (Galaxy: an unbounded node would let a short write resize the
attribute); an array value to a scalar node is refused inline. Docs: Uns.md
array-write rules + upgrade note (ReadWrite array tags become client-writable
on first boot), Modbus.md, Galaxy.md.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/EquipmentWriteGateTests.cs

@@ -129,8 +129,10 @@ public sealed class EquipmentWriteGateTests
         OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(value: 42, node).ShouldBeNull();
     }
 
-    /// <summary>(A3) Numeric-to-numeric is treated as compatible (the SDK widens/narrows numerics) — a
-    /// Double payload into an Int32 node proceeds rather than being rejected here.</summary>
+    /// <summary>(A3) SCALAR numeric-to-numeric is treated as compatible — a Double payload into an Int32 node
+    /// proceeds rather than being rejected here. Deliberately looser than the SDK (which never sees these writes:
+    /// it skips its type check when OnWriteValue is set): consumers write CLR-typed values, and every driver's
+    /// scalar encoder converts with a range check. Arrays are matched exactly instead (#610 review).</summary>
     [Fact]
     public void Structure_numeric_to_numeric_proceeds()
     {
@@ -211,6 +213,54 @@ public sealed class EquipmentWriteGateTests
         OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(new short[] { 1, 2, 3 }, node).ShouldBeNull();
     }
 
+    /// <summary>#610 review MAJOR-1 — the SDK skips its own type check when <c>OnWriteValue</c> is set, so an array
+    /// write's ELEMENT type must match the node's DataType exactly here: no numeric widening for arrays (a
+    /// <c>uint[]</c> to an Int32 node would reach MxValueEncoder's <c>int[]</c> arm by covariance and reinterpret
+    /// its bits). The matching element type is the positive control.</summary>
+    [Theory]
+    [MemberData(nameof(MistypedArrays))]
+    public void Structure_array_node_requires_the_exact_element_type(NodeId dataType, Array matching, Array mistyped)
+    {
+        var node = ArrayNode(dataType, length: 2);
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(matching, node).ShouldBeNull();
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(mistyped, node)!.StatusCode
+            .ShouldBe((StatusCode)StatusCodes.BadTypeMismatch, mistyped.GetType().Name);
+    }
+
+    public static TheoryData<NodeId, Array, Array> MistypedArrays() => new()
+    {
+        { DataTypeIds.Int16, new short[] { 1, 2 }, new[] { 1, 2 } },                    // Int32[] → Int16
+        { DataTypeIds.Int32, new[] { 1, 2 }, new uint[] { 4_000_000_000, 2 } },          // UInt32[] → Int32 (Galaxy)
+        { DataTypeIds.Int64, new long[] { 1, 2 }, new ulong[] { 1, 2 } },                // UInt64[] → Int64 (Galaxy)
+        { DataTypeIds.Float, new[] { 1f, 2f }, new[] { 1d, 2d } },                        // Double[] → Float
+        { DataTypeIds.Boolean, new[] { true, false }, new[] { 1, 0 } },                   // Int32[] → Boolean
+        { DataTypeIds.Int16, new short[] { 1, 2 }, new object[] { (short)1, (short)2 } }, // unclassifiable ⇒ refused
+    };
+
+    /// <summary>A Byte array decodes as <c>byte[]</c>, which classifies as ByteString — the one equivalence the SDK
+    /// itself honours for array nodes.</summary>
+    [Fact]
+    public void Structure_byte_array_node_takes_a_byte_array()
+    {
+        var node = ArrayNode(DataTypeIds.Byte, length: 2);
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(new byte[] { 1, 2 }, node).ShouldBeNull();
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(new sbyte[] { 1, 2 }, node)!.StatusCode
+            .ShouldBe((StatusCode)StatusCodes.BadTypeMismatch);
+    }
+
+    /// <summary>#610 review MINOR-5 — the mirror case: an array value to a scalar node is refused up front. A
+    /// byte[] (a ByteString on the wire) is a scalar and still reaches the type check; an unresolved-DataType node
+    /// defers as before.</summary>
+    [Fact]
+    public void Structure_scalar_node_refuses_an_array_value()
+    {
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(new short[] { 1 }, ValueNode(DataTypeIds.Int16))!.StatusCode
+            .ShouldBe((StatusCode)StatusCodes.BadTypeMismatch);
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure((short)1, ValueNode(DataTypeIds.Int16)).ShouldBeNull();
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(new byte[] { 1 }, ValueNode(DataTypeIds.ByteString)).ShouldBeNull();
+        OtOpcUaNodeManager.EvaluateEquipmentWriteStructure(new short[] { 1 }, ValueNode(DataTypeIds.BaseDataType)).ShouldBeNull();
+    }
+
     /// <summary>A partial (IndexRange) write is refused; an absent range proceeds.</summary>
     [Fact]
     public void Range_only_whole_value_writes_proceed()