fix(host): make a failed OPC UA SDK start visible and stop the SDK on StopAsync

A failed SDK start (port in use, PKI unwritable, bad OpcUa:* override) was one Error line: the
node stayed /health/ready 200, joined its mesh, could be elected driver Primary and acked deploys
through the Null sink while every client got connection-refused.

- IOpcUaEndpointState / OpcUaEndpointState: the start outcome is a fact the hosted service
  maintains (NotStarted / Started / Failed / Stopped + reason).
- OpcUaEndpointHealthCheck ("opcua-endpoint", Ready + Active) is Unhealthy unless Started;
  registered by AddOtOpcUaHealth(hasAdmin, hasDriver) on driver-role nodes.
- A driver-only node rethrows the start failure (Program.cs's fatal handler exits non-zero so
  the supervisor restarts it); a fused node keeps its AdminUI up but is visibly not ready.
- StopAsync detaches the sinks and then STOPS the SDK (the port closes, clients get
  connection-refused rather than a stale, inert endpoint); DisposeAsync is idempotent with it.
- The ServiceLevel calculator / redundancy election live in Cluster + Runtime (not this lane);
  the fact is exposed for the Wave 3 follow-up to consume.

Tests: port-in-use ⇒ state Failed, probe Unhealthy, real /health/ready and /health/active 503
(positive control: 200 once Started); driver-only rethrows; StopAsync closes the port and
DisposeAsync twice is a no-op; the probe registration is on both tiers for driver nodes only.

Refs #733

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -452,6 +452,11 @@ if (hasDriver)
     // mediator (for the inbound alarm-command router) without racing Akka startup — same pattern the
     // DpsScriptLogPublisher above uses. TryAdd so a fused admin+driver node registers it exactly once.
     builder.Services.TryAddSingleton<Func<ActorSystem>>(sp => () => sp.GetRequiredService<ActorSystem>());
+    // The "did the SDK start?" fact (R03:2.1): written by the hosted service, read by the opcua-endpoint
+    // health probe (AddOtOpcUaHealth below, hasDriver). One instance behind both the class and the
+    // interface, so the writer and the probe cannot disagree.
+    builder.Services.AddSingleton<OpcUaEndpointState>();
+    builder.Services.AddSingleton<IOpcUaEndpointState>(sp => sp.GetRequiredService<OpcUaEndpointState>());
     builder.Services.AddHostedService<OtOpcUaServerHostedService>();
 }
 
@@ -554,8 +559,9 @@ if (hasAdmin)
 builder.Services.AddOtOpcUaSecrets(builder.Configuration);
 
 // hasAdmin gates the configdb probe: a driver-only node registers no ConfigDb factory (see above), so
-// probing it would throw when the readiness endpoint resolves the factory.
-builder.Services.AddOtOpcUaHealth(hasAdmin);
+// probing it would throw when the readiness endpoint resolves the factory. hasDriver adds the
+// opcua-endpoint probe (ready + active): a driver node whose SDK failed to start is Unhealthy, not green.
+builder.Services.AddOtOpcUaHealth(hasAdmin, hasDriver);
 builder.Services.AddOtOpcUaObservability(builder.Configuration);
 
 // gRPC server plumbing shared by three endpoints: the LocalDb passive sync endpoint (driver-role,