fix(galaxy,s7): R2 review minors — subscribe-once deadline, probe vs backoff, write-fault ownership, null array elements, write opt-in

- Galaxy: deadline bounds the wait, not the subscribe RPC; BadTimeout for all tags and late handles unsubscribed; doc comment relocated
- S7: probe connect runs on the connect deadline so a timeout opens the backoff window
- S7: a successful write only retires a Faulted the write side owns
- S7: null array elements rejected (BadTypeMismatch); multi-PDU array writes documented non-atomic
- S7 integration: array write test gated on S7_SIM_ALLOW_WRITES=1

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/S7.md

@@ -252,7 +252,9 @@ is written as ONE contiguous `WriteBytesAsync` of `count x element-bytes` (the i
 decode), and the value must be an array of exactly `arrayLength` elements (else `BadTypeMismatch`, no
 health impact). **Writable `Bool` arrays are refused at init** (`NotSupportedException`): the array
 read is byte-granular, so a matching write would overwrite the 7 neighbouring bits of every byte it
-touches, and a safe bit-packed write needs read-modify-write. Mark Bool arrays `writable: false`.
+touches, and a safe bit-packed write needs read-modify-write. Mark Bool arrays `writable: false`. A `null` array element is rejected (`BadTypeMismatch`, nothing written)
+rather than coerced to 0. An array write larger than one PDU is split by S7.Net into several writes and is
+**not atomic** — a mid-write failure can leave the PLC array partly updated.
 Note the *server* still presents every array node read-only to OPC UA clients ([Uns.md §Array
 tags](../Uns.md#array-tags-1-d), #610 item 1) — the driver path is reachable today through the Client
 CLI / driver-level callers and is proven by the unit suite plus the snap7 fixture test