fix(galaxy,s7): R2 review minors — subscribe-once deadline, probe vs backoff, write-fault ownership, null array elements, write opt-in

- Galaxy: deadline bounds the wait, not the subscribe RPC; BadTimeout for all tags and late handles unsubscribed; doc comment relocated
- S7: probe connect runs on the connect deadline so a timeout opens the backoff window
- S7: a successful write only retires a Faulted the write side owns
- S7: null array elements rejected (BadTypeMismatch); multi-PDU array writes documented non-atomic
- S7 integration: array write test gated on S7_SIM_ALLOW_WRITES=1

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/S7-Test-Fixture.md

@@ -20,6 +20,8 @@ python-snap7 `Server` via `Docker/docker-compose.yml --profile s7_1500`
 on `10.100.0.35:1102` (the shared Docker host; override via `S7_SIM_ENDPOINT`;
 pinned `python:3.12-slim-bookworm` base +
 `python-snap7>=2.0`). Docker is the only supported launch path.
+Tests that WRITE to the endpoint (currently `S7_1500ArrayWriteTests`) additionally require
+`S7_SIM_ALLOW_WRITES=1`, because `S7_SIM_ENDPOINT` can be pointed at a real CPU; they skip without it.
 `Snap7ServerFixture` probes the port at collection init + skips with a
 clear message when unreachable (matches the pymodbus pattern).
 `server.py` (baked into the image under `Docker/`) reads a JSON profile

docs/drivers/S7.md

@@ -252,7 +252,9 @@ is written as ONE contiguous `WriteBytesAsync` of `count x element-bytes` (the i
 decode), and the value must be an array of exactly `arrayLength` elements (else `BadTypeMismatch`, no
 health impact). **Writable `Bool` arrays are refused at init** (`NotSupportedException`): the array
 read is byte-granular, so a matching write would overwrite the 7 neighbouring bits of every byte it
-touches, and a safe bit-packed write needs read-modify-write. Mark Bool arrays `writable: false`.
+touches, and a safe bit-packed write needs read-modify-write. Mark Bool arrays `writable: false`. A `null` array element is rejected (`BadTypeMismatch`, nothing written)
+rather than coerced to 0. An array write larger than one PDU is split by S7.Net into several writes and is
+**not atomic** — a mid-write failure can leave the PLC array partly updated.
 Note the *server* still presents every array node read-only to OPC UA clients ([Uns.md §Array
 tags](../Uns.md#array-tags-1-d), #610 item 1) — the driver path is reachable today through the Client
 CLI / driver-level callers and is proven by the unit suite plus the snap7 fixture test