fix(s7commplus): decode struct PValues per the real wire format (packed + normal)

[ale-rinaldi]

Summary

decode_pvalue_to_bytes treated every Struct (0x17) as a VLQ element count followed by that many nested PValues. A real S7-1500 uses neither shape — the leading struct id is a fixed UInt32, and the body comes in two forms (matching ValueStruct.Deserialize in the thomas-v2/S7CommPlusDriver reference):

• Packed struct — system datatypes (DTL, …) and optimized-DB struct reads; id in 0x90000000..0x9fffffff or 0x02000000..0x02ffffff. Layout: UInt64 interface timestamp, VLQ transport flags, VLQ element count (a second count follows when the Count2Present flag, bit 10, is set), then the members as one raw byte blob — returned verbatim for the caller to interpret with the struct's member layout.
• Normal struct — members as [VLQ key][PValue], terminated by a 0 key.

Why

Reading a struct node (rather than each scalar leaf) previously returned garbage / raised. With this, a single read_symbolic of a struct returns the correct member bytes.

Test plan

• New unit tests: normal struct, packed struct, and packed struct with Count2Present (two counts).
• pytest tests/test_s7_codec.py — 99 passed; full pytest tests/ green; ruff clean.
• Live: reading a struct node on a real S7-1500 returns the packed member bytes that decode to the expected scalar (Int) members — matching the individual leaf reads.

Pairs with the V2 wire-format fixes in #745 (which makes the struct reachable), but the codec change here is self-contained.

🤖 Generated with Claude Code

[gijzelaerr]

Test review

[gijzelaerr]

Review Summary

Clean, well-scoped PR. The codec change correctly handles both packed and normal struct formats per the C# reference driver, and the tests cover the key cases (normal struct, packed struct, packed with Count2Present).

No security concerns — this is purely wire format decoding with no I/O or external calls. No malicious patterns.

One potential correctness bug flagged inline (struct id range checks use exclusive < instead of inclusive <=).

[gijzelaerr]

Good test coverage. Consider adding an edge-case test with struct_id = 0x90000000 (boundary value) to verify it's treated as a packed struct — currently the < comparison would misclassify it.

[ale-rinaldi]

Added test_struct_id_boundary_is_normal, covering 0x90000000, 0x9FFFFFFF, 0x02000000, 0x02FFFFFF. It asserts they parse as normal structs (not packed): the ranges are exclusive per the C# reference (details in the other thread), so the bounds are base sentinels rather than packed-struct ids.