fix(abcip): #611 review round 1 — native keeps BOOL type distinction, WriteWidthRefusal tests, doc caveats

- L2: WriteWidthRefusal leaves a BOOL over a wider value to a runtime that sees the CIP
  type (native): mistyped integer member -> BadTypeMismatch (as its read), 0xD3 BOOL-array
  DWORD -> BadNotSupported; libplctag keeps BadNotSupported for both (size only).
- L4: direct theory over WriteWidthRefusal (1/2/4/8 widths incl LINT/ULINT/LREAL, String/Dt,
  unknown size) + array/bit-selector exemptions with a non-vacuous control.
- L1: CLAUDE.md member/BIT-member writes are ab_server-proven only.
- L3: patch 0003 blind spots documented (Docker README, AbServer-Test-Fixture.md); nits.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/AbServer-Test-Fixture.md

@@ -55,7 +55,9 @@ smoke test passes on both transports. Evidence:
 - ab_server serves no UDTs, so template parity is vacuous there. Docker patch 0003 serves a UDT **member
   path** from a flat tag named by that dotted path (`UdtSeg.ID`, `UdtSeg.Sub.Code`, `UdtSeg.Points[2]`) — the
   wire of a member read/write, not a structure — and accepts the pad byte libplctag adds to a 1-byte write,
-  which stock ab_server refused (`0x03`) for every libplctag BOOL/SINT write. Native writes remain
+  which stock ab_server refused (`0x03`) for every libplctag BOOL/SINT write. Two blind spots follow (see
+  the Docker README §0003): a +1-byte over-write of an odd-sized tag is no longer caught, and a malformed
+  single segment `"UdtSeg.ID"` resolves where a real Logix would refuse it. Native writes remain
   simulator-only.
 - **Golden-frame capture:** `scripts/ab-capture/capture.sh` (capture client in `scripts/ab-capture/client`);
   fixtures live in `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.Tests/Captures/` with a README.