fix(CLI-37,CLI-38): make status/HRESULT reply validation conformant across all five clients

One cross-client conformance pass; also closes first-cycle CLI-08.

CLI-37: an MxStatusProxy entry is a failure iff `category !=
MX_STATUS_CATEGORY_OK`. The proto contract has always said so — `success` is
the raw 16-bit COM member carried verbatim for diagnostics, not a boolean — but
four clients branched on `success` alone and .NET required both, so the same
gateway reply produced opposite verdicts per language. An absent entry stays
success; a present entry with an UNSPECIFIED category is a failure, because the
worker always maps a category and an unmapped one is not proven OK.

CLI-38: a reply fails on HRESULT iff `hresult` is present and negative, so
positive COM success codes such as S_FALSE (1) pass. .NET/Go/Java used `!= 0`,
which errored on a parity-preserving S_FALSE that Python and Rust accepted.
This makes the existing ClientLibrariesDesign.md claim true rather than
rewriting the doc to describe the divergence.

Four shared fixtures pin both rules cross-client, and each language suite also
carries a table test for the two edges a fixture cannot express (absent entry,
UNSPECIFIED category). A Java test fake that built a status with a bare
`setSuccess(1)` and no category is fixed — under the category rule that reply
was never a success.

clients/python/tests/test_errors.py

@@ -32,6 +32,55 @@ def test_write_failure_fixture_preserves_raw_reply() -> None:
     assert len(captured.value.raw_reply.statuses) == 2
 
 
+@pytest.mark.parametrize(
+    ("fixture", "expect_failure"),
+    [
+        ("command-replies/register.ok.reply.json", False),
+        ("command-replies/write.status-category-error-success-set.reply.json", True),
+        ("command-replies/write.status-category-ok-success-zero.reply.json", False),
+        ("command-replies/write.hresult-s-false.reply.json", False),
+        ("command-replies/write.hresult-e-fail.reply.json", True),
+    ],
+)
+def test_reply_validation_fixtures_branch_on_category_and_negative_hresult(
+    fixture: str,
+    expect_failure: bool,
+) -> None:
+    reply = _load_reply(fixture)
+
+    if expect_failure:
+        with pytest.raises(MxAccessError):
+            ensure_mxaccess_success("write", reply)
+    else:
+        assert ensure_mxaccess_success("write", reply) is reply
+
+
+@pytest.mark.parametrize(
+    ("category", "success", "expect_failure"),
+    [
+        (pb.MX_STATUS_CATEGORY_OK, 0, False),
+        (pb.MX_STATUS_CATEGORY_OK, 1, False),
+        (pb.MX_STATUS_CATEGORY_COMMUNICATION_ERROR, 1, True),
+        (pb.MX_STATUS_CATEGORY_UNSPECIFIED, 1, True),
+    ],
+)
+def test_status_entry_verdict_ignores_the_raw_success_member(
+    category: int,
+    success: int,
+    expect_failure: bool,
+) -> None:
+    reply = pb.MxCommandReply(
+        protocol_status=pb.ProtocolStatus(code=pb.PROTOCOL_STATUS_CODE_OK),
+        statuses=[pb.MxStatusProxy(success=success, category=category)],
+    )
+
+    if expect_failure:
+        with pytest.raises(MxAccessError):
+            ensure_mxaccess_success("write", reply)
+    else:
+        assert ensure_mxaccess_success("write", reply) is reply
+
+
 def test_session_status_maps_to_session_error() -> None:
     status = pb.ProtocolStatus(
         code=pb.PROTOCOL_STATUS_CODE_SESSION_NOT_FOUND,