Task #253 follow-up — driver-side e2e debug: port fixes + HR[200] scratch register

Ran the driver CLIs against the live docker-compose fixtures to debug
what actually works. Two real bugs surfaced:

1. `e2e-config.sample.json` pointed at the wrong simulator ports:
     - Modbus: 5502 → **5020** (pymodbus compose binding)
     - S7:      102 → **1102** (python-snap7, non-priv port)
     - AbCip:   no port → now explicit **:44818**
   `test-modbus.ps1` default `-ModbusHost` also shipped with 5502;
   fixed to 5020.

2. Modbus loopback was off-by-2 because pymodbus `standard.json` makes
   HR[100] an auto-increment register (value ticks on every poll).
   Switched `test-modbus.ps1` to **HR[200]** (scratch range in the
   profile) + updated sample config `bridgeNodeId` to match.

Also fixed the AbCip probe: `-t @raw_cpu_type` was rejected by the
driver's TagPath parser ("malformed TagPath"). Probe now uses the
user-supplied `-TagPath` for every family. Works against both
ab_server and real controllers.

Verified driver-side against live containers:
 - Modbus  5020:  probe ✓, HR[200] write+read round-trip ✓
 - AB CIP  44818: probe ✓, TestDINT write+read round-trip ✓
 - S7      1102:  probe ✓, DB1.DBW0 write+read round-trip ✓

## Known blocker (stages 3-5)

README now flags — and the 4 child issues under umbrella #209 track —
that `src/ZB.MOM.WW.OtOpcUa.Server/Program.cs:98-104` only registers
Galaxy + FOCAS driver factories. `DriverInstanceBootstrapper` silently
skips any `DriverType` without a registered factory, so stages 3-5
(anything crossing the OPC UA server) can't work today even with a
perfect Config DB seed. Issues #210-213 scope the factory + seed SQL
work per driver.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/e2e/test-abcip.ps1

@@ -53,18 +53,12 @@ $opcUaCli = Get-CliInvocation `
 $commonAbCip = @("-g", $Gateway, "-f", $Family)
 $results = @()
 
-# Probe via @raw_cpu_type for ControlLogix; against ab_server this surfaces the
-# string 'Controllogix'. Other families use the main TestDINT.
-$probeTag = if ($Family -eq "ControlLogix" -or $Family -eq "CompactLogix" -or $Family -eq "GuardLogix") {
-    "@raw_cpu_type"
-} else {
-    $TagPath
-}
-$probeType = if ($probeTag -eq "@raw_cpu_type") { "String" } else { "DInt" }
-
+# The AbCip driver's TagPath parser rejects CIP attribute syntax like
+# `@raw_cpu_type` ("malformed TagPath"), so probe uses the real TagPath for
+# every family. Works against ab_server + real controllers alike.
 $results += Test-Probe `
     -Cli $abcipCli `
-    -ProbeArgs (@("probe") + $commonAbCip + @("-t", $probeTag, "--type", $probeType))
+    -ProbeArgs (@("probe") + $commonAbCip + @("-t", $TagPath, "--type", "DInt"))
 
 $writeValue = Get-Random -Minimum 1 -Maximum 9999
 $results += Test-DriverLoopback `