fix(galaxy,s7): R2 review minors — subscribe-once deadline, probe vs backoff, write-fault ownership, null array elements, write opt-in

- Galaxy: deadline bounds the wait, not the subscribe RPC; BadTimeout for all tags and late handles unsubscribed; doc comment relocated
- S7: probe connect runs on the connect deadline so a timeout opens the backoff window
- S7: a successful write only retires a Faulted the write side owns
- S7: null array elements rejected (BadTypeMismatch); multi-PDU array writes documented non-atomic
- S7 integration: array write test gated on S7_SIM_ALLOW_WRITES=1

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/Docker/README.md

@@ -57,6 +57,8 @@ rsync -av --rsync-path="sudo rsync" \
 - Default: `localhost:1102` (non-privileged; sidesteps Windows Firewall
   prompt + Linux's root-required bind on port 102).
 - Override with `S7_SIM_ENDPOINT` to point at a real S7 CPU on `:102`.
+- Tests that write (`S7_1500ArrayWriteTests`) run only with `S7_SIM_ALLOW_WRITES=1`, so a real-CPU
+  endpoint is never written by accident.
 - The driver's S7DriverOptions.Port flows through S7netplus's 5-arg
   `Plc(CpuType, host, port, rack, slot)` ctor so the non-standard port
   works end-to-end.