fix(galaxy,s7): R2 review minors — subscribe-once deadline, probe vs backoff, write-fault ownership, null array elements, write opt-in

- Galaxy: deadline bounds the wait, not the subscribe RPC; BadTimeout for all tags and late handles unsubscribed; doc comment relocated
- S7: probe connect runs on the connect deadline so a timeout opens the backoff window
- S7: a successful write only retires a Faulted the write side owns
- S7: null array elements rejected (BadTypeMismatch); multi-PDU array writes documented non-atomic
- S7 integration: array write test gated on S7_SIM_ALLOW_WRITES=1

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/S7_1500/S7_1500ArrayWriteTests.cs

@@ -7,7 +7,8 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests.S7_1500;
 /// <summary>
 ///     #610 item 2 (S7-016): array write round trip against the python-snap7 S7-1500 profile. Skips
 ///     cleanly when the sim is absent. Uses DB1 bytes 700+ (the profile's 1024-byte DB1 has no seed
-///     there), so the writes cannot disturb another test's seeds.
+///     there), so the writes cannot disturb another test's seeds. Writes also require
+///     <c>S7_SIM_ALLOW_WRITES=1</c>.
 /// </summary>
 [Collection(Snap7ServerCollection.Name)]
 [Trait("Category", "Integration")]
@@ -33,6 +34,9 @@ public sealed class S7_1500ArrayWriteTests(Snap7ServerFixture sim)
     public async Task Array_write_then_read_round_trips_through_real_S7comm()
     {
         if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        // S7_SIM_ENDPOINT may point at a real CPU; writing needs an explicit opt-in (simulator runs only).
+        if (Environment.GetEnvironmentVariable("S7_SIM_ALLOW_WRITES") != "1")
+            Assert.Skip("Write test: set S7_SIM_ALLOW_WRITES=1 to allow writes to the endpoint under test (simulator only).");
 
         await using var drv = new S7Driver(Options(sim.Host, sim.Port), "s7-arr-write");
         await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);