Separate the OPC UA logic of the Workshop clients from their windows

[romanett]

Every Workshop sample client kept its whole OPC UA logic inside MainForm.cs, in async void handlers next to the ListView updates. That is why the samples could only be tested through a never-shown form on an STA thread driven by reflection, and why defects in the sample logic (the RoleManagement Reset button, the HistoricalEvents DateTimeUtc unbox, the AlarmCondition reentrancy) survived until a user pressed a button. The servers already went through this split (#856); this PR does the clients.

What changes

• New library Samples/Client.Common (Opc.Ua.Samples.Client), the UI-free half of a sample client: the SampleClientModel base class (attach/detach lifecycle, reconnect entry points, events posted to the thread the model was created on, a detach that never throws because the connect control disposes its session before it reports the disconnect), SampleSession (the helpers moved out of ClientUtils, which keeps forwarders so nothing else changes), SubscriptionPump, SerialNotificationPump<T>, OperationResult and SampleSessionFactory. See its README.
• All 18 Workshop clients get a Model/<X>ClientModel.cs which never references Windows Forms, and a thin MainForm.cs which hands the connect control's session to the model and renders its events. The Boiler client is the reference implementation, the Empty client the template. Every name tier 2 reflects on survived verbatim; the only tier 2 source edit is the ConditionSnapshot cast in SampleClientActionTests.
• New test tier 1.7, Tests/SampleClientModels.Tests: a fixture per model against the in-process sample server over a managed session, no STA thread, no message loop, no reflection. ModelContractTests enforces the rule by reflection: any field, property, event, parameter or return type from System.Windows.Forms, System.Drawing or the control library in a Model namespace fails, and so does a client without a model.
• AlarmCondition reentrancy fixed by design: the V2 event callback only posts into a SerialNotificationPump, one consumer does the awaits in arrival order; the fixture asserts that handlers are never entered concurrently and that the list is cleared before a refresh replays.
• Docs: docs/TESTING.md (the tier, the fourth "why this works" property, a fixture column in the per-client table), the library README, links from the Hosting README and the root README.

Verification

All five tiers on the merged branch, both solutions building with zero errors:

Tier	Result
0 Configuration	183 passed
1 Servers	115 passed
1.5 Node managers	160 passed, 3 skipped (existing known issues)
1.7 Client models	318 passed, 3 skipped (known issues, fail when they start passing)
2 Client smoke	61 passed

Worth knowing

• The AlarmCondition model uses the item-level condition refresh, adds the RefreshStart/RefreshEnd types to its event filter, and removes the old monitored item before adding the new one on a filter swap. All three were measured against preview.4: the subscription-level refresh replays nothing, the markers are run through the where clause, and add-then-remove leaves the new item without live events.
• Two HistoricalEvents behaviours the original form got wrong are fixed on the way: the "first event time" read sent no end bound and always fell back, and two events could interleave on the UI thread.
• The follow-ups this PR leaves open (the Reference/Sample/GDS clients, the control library, DI registration of the models, Workshop/Common) are collected in Client models: the follow-ups left open by the Workshop client split #865.

🤖 Generated with Claude Code

[romanett]

Merged master (through #864) into the branch. The four clients master extended after the split (RoleManagement's Part 18 items, StateMachines' sub state machines, NodeManagement's ModelChangeTracker, the Kerberos removal in UserAuthentication) have their new features in the models, not back in the windows, and the model fixtures cover them. On the merged tree: solution builds with 0 errors; tier 1 116 passed; tier 1.7 346 passed, 3 skipped; tier 2 62 passed with one timing flake (PerfTest Stop under load) which passes on rerun.