Galaxy E2E — point at live writable historized attribute + MachineStatus

Pick a Galaxy attribute that actually exercises the full driver stack:
TestMachine_001.TestHistoryValue. Verified against the live dev-box ZB:
it's Int32, writable (security_classification = Operate), and historized
(HistoryExtension primitive). The query lives in
`gr/queries/attributes_extended.sql` — swap to any other writable
historized attribute via the same shape
(`WHERE is_historized = 1 AND security_classification > 0`).

Seed changes:
- Tag row: FullName = TestMachine_001.TestHistoryValue (Int32 / ReadWrite)
- VirtualTag renamed: `Doubled` → `MachineStatus` (Boolean), script returns
  `Source > 0`. Historized, so the write/subscribe exercise doubles as a
  historian-sink check once the alarm/write stages are enabled.
- Scripted alarm predicate reads the same Source and fires on `> 50`.
- Added ClusterNodeCredential(sa → p7-smoke-node) row so
  sp_GetCurrentGenerationForCluster's caller-binding check passes. Without
  this the server bootstrap fails with
  `Unauthorized: caller sa is not bound to NodeId p7-smoke-node`.

E2E script:
- Path-based NodeId defaults updated to match the new MachineStatus
  virtual tag.
- Added optional `-Username / -Password` parameters. Anonymous sessions
  still get denied against Operate-classified attributes (PR 26 /
  docs/Security.md); supplying `-Username writeop -Password writeop123`
  against the dev-box GLAuth exercises the reverse-bridge stage.
- Wired those credentials into every Invoke-Cli / Start-Process CLI
  invocation the script drives.

Anonymous smoke remains 3/7 pass (probe + source read + reverse-bridge
marked acl-expected INFO). A fuller run with
`-Username writeop -Password writeop123` requires also enabling LDAP +
a SecurityProfile that carries a UserName UserTokenPolicy — separate
config step tracked alongside #124 (3-user authz matrix).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/smoke/seed-phase-7-smoke.sql

@@ -71,6 +71,13 @@ INSERT dbo.ClusterNode(NodeId, ClusterId, RedundancyRole, Host, OpcUaPort, Dashb
 VALUES (@NodeId, @ClusterId, 'Primary', 'localhost', 4840, 5000,
         'urn:OtOpcUa:p7-smoke-node', 200, 1, 'p7-smoke');
 
+-- sp_GetCurrentGenerationForCluster gates access by SUSER_SNAME() against
+-- ClusterNodeCredential; without this binding the Server bootstrap fails with
+-- `Unauthorized: caller sa is not bound to NodeId p7-smoke-node`. Dev Docker
+-- SQL runs with `sa`; production deploys would rotate to a per-node login.
+INSERT dbo.ClusterNodeCredential(NodeId, Kind, Value, Enabled, CreatedBy)
+VALUES (@NodeId, N'SqlLogin', N'sa', 1, N'p7-smoke');
+
 -- 2. Generation (created Draft, flipped to Published at the end so insert order
 --    constraints (one Draft per cluster, etc.) don't fight us).
 DECLARE @Gen bigint;
@@ -106,30 +113,43 @@ VALUES (@Gen, @DrvId, @ClusterId, @NsId, 'galaxy-smoke', 'Galaxy', N'{
 }', 1);
 
 -- 6. One driver-sourced Tag bound to the Equipment. TagConfig is the Galaxy
---    fullRef ("DelmiaReceiver_001.DownloadPath" style); replace with a real
---    attribute on this Galaxy. The script paths below use
---    /lab-floor/galaxy-line/reactor-1/Source which the EquipmentNodeWalker
---    emits + the DriverSubscriptionBridge maps to this driver fullRef.
+--    fullRef; the EquipmentNodeWalker reads the JSON's FullName field and
+--    hands that string to the Galaxy driver as the MXAccess reference.
+--    Default points at TestMachine_001.TestHistoryValue — the live dev-box
+--    Galaxy ships it as Int32 + writable (security_classification=Operate)
+--    + historized (HistoryExtension primitive), so the E2E script can
+--    exercise read + write + subscribe + alarm + history against the
+--    same attribute. Swap to any other writable historized attribute on
+--    this Galaxy by re-running `gr/queries/attributes_extended.sql` with
+--    `WHERE is_historized=1 AND security_classification > 0`.
 INSERT dbo.Tag(GenerationId, TagId, DriverInstanceId, EquipmentId, Name, DataType,
                AccessLevel, TagConfig, WriteIdempotent)
-VALUES (@Gen, @TagId, @DrvId, @EqId, 'Source', 'Float64', 'Read',
-        N'{"FullName":"REPLACE_WITH_REAL_GALAXY_ATTRIBUTE","DataType":"Float64"}', 0);
+VALUES (@Gen, @TagId, @DrvId, @EqId, 'Source', 'Int32', 'ReadWrite',
+        N'{"FullName":"TestMachine_001.TestHistoryValue","DataType":"Int32"}', 0);
 
 -- 7. Scripts (SourceHash is SHA-256 of SourceCode, computed externally — using
 --    a placeholder here; the engine recomputes on first use anyway).
+--
+--    MachineStatus predicate — the dynamic "is the machine running?" status
+--    derived from the raw Source value. Boolean: true when Source > 0. Matches
+--    the shape Aveva operators typically want on a machine-status tile (green
+--    when above zero, otherwise grey) without needing a separate threshold
+--    attribute. Rename + re-threshold here to mirror site semantics.
 INSERT dbo.Script(GenerationId, ScriptId, Name, SourceCode, SourceHash, Language)
 VALUES
-  (@Gen, @VtScript, 'doubled-source',
-   N'return ((double)ctx.GetTag("/lab-floor/galaxy-line/reactor-1/Source").Value) * 2.0;',
+  (@Gen, @VtScript, 'machine-status-predicate',
+   N'return System.Convert.ToInt32(ctx.GetTag("/lab-floor/galaxy-line/reactor-1/Source").Value) > 0;',
    '0000000000000000000000000000000000000000000000000000000000000000', 'CSharp'),
   (@Gen, @AlScript, 'overtemp-predicate',
-   N'return ((double)ctx.GetTag("/lab-floor/galaxy-line/reactor-1/Source").Value) > 50.0;',
+   N'return System.Convert.ToInt32(ctx.GetTag("/lab-floor/galaxy-line/reactor-1/Source").Value) > 50;',
    '0000000000000000000000000000000000000000000000000000000000000000', 'CSharp');
 
--- 8. VirtualTag — derived value computed by Roslyn each time Source changes.
+-- 8. VirtualTag — MachineStatus boolean computed by Roslyn each time Source
+--    changes. Historized so the dashboard can plot a running/idle timeline
+--    next to the raw TestHistoryValue trend from Aveva Historian.
 INSERT dbo.VirtualTag(GenerationId, VirtualTagId, EquipmentId, Name, DataType,
                       ScriptId, ChangeTriggered, TimerIntervalMs, Historize, Enabled)
-VALUES (@Gen, @VtId, @EqId, 'Doubled', 'Float64', @VtScript, 1, NULL, 0, 1);
+VALUES (@Gen, @VtId, @EqId, 'MachineStatus', 'Boolean', @VtScript, 1, NULL, 1, 1);
 
 -- 9. ScriptedAlarm — Active when Source > 50.
 INSERT dbo.ScriptedAlarm(GenerationId, ScriptedAlarmId, EquipmentId, Name, AlarmType,