Task #253 follow-up — driver-side e2e debug: port fixes + HR[200] scratch register

Ran the driver CLIs against the live docker-compose fixtures to debug
what actually works. Two real bugs surfaced:

1. `e2e-config.sample.json` pointed at the wrong simulator ports:
     - Modbus: 5502 → **5020** (pymodbus compose binding)
     - S7:      102 → **1102** (python-snap7, non-priv port)
     - AbCip:   no port → now explicit **:44818**
   `test-modbus.ps1` default `-ModbusHost` also shipped with 5502;
   fixed to 5020.

2. Modbus loopback was off-by-2 because pymodbus `standard.json` makes
   HR[100] an auto-increment register (value ticks on every poll).
   Switched `test-modbus.ps1` to **HR[200]** (scratch range in the
   profile) + updated sample config `bridgeNodeId` to match.

Also fixed the AbCip probe: `-t @raw_cpu_type` was rejected by the
driver's TagPath parser ("malformed TagPath"). Probe now uses the
user-supplied `-TagPath` for every family. Works against both
ab_server and real controllers.

Verified driver-side against live containers:
 - Modbus  5020:  probe ✓, HR[200] write+read round-trip ✓
 - AB CIP  44818: probe ✓, TestDINT write+read round-trip ✓
 - S7      1102:  probe ✓, DB1.DBW0 write+read round-trip ✓

## Known blocker (stages 3-5)

README now flags — and the 4 child issues under umbrella #209 track —
that `src/ZB.MOM.WW.OtOpcUa.Server/Program.cs:98-104` only registers
Galaxy + FOCAS driver factories. `DriverInstanceBootstrapper` silently
skips any `DriverType` without a registered factory, so stages 3-5
(anything crossing the OPC UA server) can't work today even with a
perfect Config DB seed. Issues #210-213 scope the factory + seed SQL
work per driver.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/e2e/test-modbus.ps1

@@ -7,17 +7,22 @@
   Five assertions:
     1. `otopcua-modbus-cli probe` hits the simulator
     2. Driver-loopback write + read-back via modbus-cli
-    3. Forward bridge: modbus-cli writes HR[100], OPC UA client reads the bridged NodeId
-    4. Reverse bridge: OPC UA client writes the NodeId, modbus-cli reads HR[100]
+    3. Forward bridge: modbus-cli writes HR[200], OPC UA client reads the bridged NodeId
+    4. Reverse bridge: OPC UA client writes the NodeId, modbus-cli reads HR[200]
     5. Subscribe-sees-change: OPC UA subscription observes a modbus-cli write
 
-  Requires a running Modbus simulator on localhost:5502 (the pymodbus fixture
-  default per docs/drivers/Modbus-Test-Fixture.md) and a running OtOpcUa server
-  whose config DB has a Modbus DriverInstance bound to that simulator + a Tag
-  at HR[100] Int16 published under the NodeId passed via -BridgeNodeId.
+  Requires a running Modbus simulator on localhost:5020 (the pymodbus fixture
+  default — see tests/.../Modbus.IntegrationTests/Docker/docker-compose.yml)
+  and a running OtOpcUa server whose config DB has a Modbus DriverInstance
+  bound to that simulator + a Tag at HR[200] UInt16 published under the
+  NodeId passed via -BridgeNodeId.
+
+  NOTE: HR[200] (not HR[100]) — pymodbus standard.json makes HR[100] an
+  auto-incrementing register that mutates every poll, so loopback writes
+  can't be verified there.
 
 .PARAMETER ModbusHost
-  Host:port of the Modbus simulator. Default 127.0.0.1:5502.
+  Host:port of the Modbus simulator. Default 127.0.0.1:5020.
 
 .PARAMETER OpcUaUrl
   Endpoint URL of the OtOpcUa server. Default opc.tcp://localhost:4840.
@@ -31,7 +36,7 @@
 #>
 
 param(
-    [string]$ModbusHost = "127.0.0.1:5502",
+    [string]$ModbusHost = "127.0.0.1:5020",
     [string]$OpcUaUrl = "opc.tcp://localhost:4840",
     [Parameter(Mandatory)] [string]$BridgeNodeId
 )
@@ -59,14 +64,14 @@ $results += Test-Probe `
 $writeValue = Get-Random -Minimum 1 -Maximum 9999
 $results += Test-DriverLoopback `
     -Cli $modbusCli `
-    -WriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16", "-v", $writeValue)) `
-    -ReadArgs  (@("read")  + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16")) `
+    -WriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "200", "-t", "UInt16", "-v", $writeValue)) `
+    -ReadArgs  (@("read")  + $commonModbus + @("-r", "HoldingRegisters", "-a", "200", "-t", "UInt16")) `
     -ExpectedValue "$writeValue"
 
 $bridgeValue = Get-Random -Minimum 10000 -Maximum 19999
 $results += Test-ServerBridge `
     -DriverCli $modbusCli `
-    -DriverWriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16", "-v", $bridgeValue)) `
+    -DriverWriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "200", "-t", "UInt16", "-v", $bridgeValue)) `
     -OpcUaCli $opcUaCli `
     -OpcUaUrl $OpcUaUrl `
     -OpcUaNodeId $BridgeNodeId `
@@ -78,7 +83,7 @@ $results += Test-OpcUaWriteBridge `
     -OpcUaUrl $OpcUaUrl `
     -OpcUaNodeId $BridgeNodeId `
     -DriverCli $modbusCli `
-    -DriverReadArgs (@("read") + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16")) `
+    -DriverReadArgs (@("read") + $commonModbus + @("-r", "HoldingRegisters", "-a", "200", "-t", "UInt16")) `
     -ExpectedValue "$reverseValue"
 
 $subValue = Get-Random -Minimum 30000 -Maximum 39999
@@ -87,7 +92,7 @@ $results += Test-SubscribeSeesChange `
     -OpcUaUrl $OpcUaUrl `
     -OpcUaNodeId $BridgeNodeId `
     -DriverCli $modbusCli `
-    -DriverWriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "100", "-t", "UInt16", "-v", $subValue)) `
+    -DriverWriteArgs (@("write") + $commonModbus + @("-r", "HoldingRegisters", "-a", "200", "-t", "UInt16", "-v", $subValue)) `
     -ExpectedValue "$subValue"
 
 Write-Summary -Title "Modbus e2e" -Results $results