SIENTIAPDE-1974: feat(read): keep the legacy OpcManager as plan B (READ_ENGINE)

The rc3 OpcManager is restored unchanged (with its tests and
scripts/generate-and-push-opc-cert.sh) for validation and as a fallback until
the end of SIENTIAPDE-1974; it is removed only once it is unused and the test
suite passes the same without it.

- READ_ENGINE=v2 (default): ServerReader/SubscriptionEngine over the shared
  pool, certificate from MinIO. READ_ENGINE=legacy: the rc3 OpcManager with
  its own connection, slot v1 only (a v2 slot is rejected and notified) and
  the certificate files of the Gitea clone. An invalid value falls back to v2
  with a warning. Writes/gRPC always use the pool.
- pool: OPC clients carry the pod id as application/session name and product
  URI (as OpcManager did), so each pod's session is recognizable in the
  server console; application_uri stays the server_uri (certificate SAN).
- README/CLAUDE.md document the plan B and how to remove it.

Tests: 275 unit tests pass (restored OpcManager tests unchanged); ruff clean.
Local e2e: both engines read the same slot v1 from an asyncua server and write
identical documents to the same collections.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -219,6 +219,25 @@ Requirements for a server to accept the connection:
 MinIO is only contacted when a certificate is first needed, so a MinIO outage only
 affects secured servers, which are retried on the next main-loop iteration.
 
+### Plan B: legacy read engine (`READ_ENGINE=legacy`)
+
+Until the end of SIENTIAPDE-1974 the legacy reader is kept for validation and as a
+fallback. `READ_ENGINE` selects the read path (default `v2`; an invalid value falls
+back to `v2` with a warning):
+
+| `READ_ENGINE` | Reader | Slot | Certificate |
+|---|---|---|---|
+| `v2` (default) | `ServerReader` + `SubscriptionEngine` over the shared pool | v1 or v2 | MinIO + Mongo (`CertProvider`), `Basic256Sha256` |
+| `legacy` | the rc3 `OpcManager`, unchanged, with its own connection | **v1 only** (a v2 slot is rejected and notified) | files from the repository the pod clones (`cert_path` / `private_key_path` in the slot), `Basic256` |
+
+Writes and gRPC always use the pool (MinIO certificate), whatever the read engine.
+The legacy engine needs the certificate files in the Gitea branch the pod clones;
+`scripts/generate-and-push-opc-cert.sh` generates them and pushes them to
+`certs/` (`GITEA_PASSWORD='<senha>' BRANCH=<branch> ./scripts/generate-and-push-opc-cert.sh`).
+Each version deploy creates a new Gitea branch without `certs/`, so they have to be
+copied again for the legacy engine. Remove the legacy engine (OpcManager, its tests
+and the script) once it is unused and the test suite passes the same without it.
+
 ## 🧪 Testing
 
 ### Unit Tests
@@ -347,13 +366,14 @@ sientia-dataops-opc-ingestor/
 │   ├── managers/            # Component managers
 │   │   ├── data_manager.py # Data persistence and export
 │   │   ├── ingestor_manager.py # Main coordination
+│   │   ├── opc_manager.py  # Legacy reader, plan B (READ_ENGINE=legacy)
 │   │   ├── resource_manager.py # Resource coordination
 │   │   └── server_reader.py # OPC UA server reads (SubscriptionEngine + pool)
 │   ├── app.py              # Main application entry point
 │   ├── ingestor.py         # Core ingestor logic
 │   └── metrics.py          # Prometheus metrics definitions
 ├── simulator/               # OPC simulation and testing tools
-├── scripts/                 # Ops scripts (e.g. e2e seed)
+├── scripts/                 # Ops scripts (e2e seed; legacy OPC cert generation)
 ├── tests/                   # Test suite
 └── requirements.txt         # Python dependencies
 ```