Implement and validate S7CommPlus CPU operating-state APIs

[gijzelaerr]

Problem

The S7CommPlus CPU operating-state APIs are not currently trustworthy on real S7-1500 hardware.

S7CommPlusClient.get_cpu_state() and its async equivalent send an EXPLORE request for NATIVE_THE_CPU_EXEC_UNIT_RID, but do not parse an operating-state attribute. They currently return RUN whenever the response is non-empty and UNKNOWN otherwise, so a stopped PLC can be reported as running.

set_plc_operating_state() sends an INVOKE request using the current generic payload builder, but the request and response have not been validated against a working TIA Portal/reference-library trace. Real-hardware testing on S7-1500 FW 3.x reports that both reading and setting CPU state do not work correctly.

Related hardware-validation work: #793.

Evidence needed

A decrypted S7CommPlus trace from a working reference implementation for each operation:

• read state while the CPU is in RUN
• read state while the CPU is in STOP
• request STOP from RUN, including the response
• request RUN from STOP, including the response

Please include the PLC order number and firmware version, but omit network addresses and credentials.

Implementation

• identify and parse the actual operating-state attribute from the CPU execution-unit response
• build the state-change INVOKE request byte-for-byte from a working capture
• validate the PLC return value instead of ignoring the response
• use a public enum for requested and returned states rather than bare integers/guessed strings
• keep sync and async behavior equivalent
• add capture-derived request/response fixtures

Acceptance criteria

• RUN and STOP are distinguished from captured responses
• state-change errors are surfaced with the PLC return code
• RUN → STOP and STOP → RUN work on real S7-1500 hardware
• unsupported/unknown state values are represented without silently defaulting to RUN
• sync and async tests cover the same wire behavior

@xBiggs, if you can provide the four traces above from the FW 3.x PLC, they should be enough to implement this without guessing.