feat(climate): hydrate cold subordinate zones via one-shot *#4*Z## once live #0 central unit is confirmed #813

Problem

On SCS-only gateways whose firmware drops the general thermoregulation sweep *#4*0## (F450, F454, F459, H4684, MH200, MH201, MH202), #794 polls each zone's ambient temperature at startup via *#4*<WHERE>*0##.

Keeping *#4*<WHERE>*0## as the baseline startup poll is fast (~120 ms / 1 SCS telegram per zone), light on single-worker gateways (MH200, MH201) and F422 buffers, and sufficient on warm restarts where RestoreEntity restores target_temperature / local_offset and *#4*#0## refreshes global seasonal mode.

However, two gaps remain on plants coordinated by a 99-zone central unit (WHERE = #0, e.g. BTicino 3550 / MyHOME_Screen):

1. Day-0 blank-start discovery (empty entity registry, no myhome.yaml): when subordinate zones (1..99) are discovered from bus frames (*#4*Z*0*TTTT## or *#4*Z#N*20*S##), *#4*Z*0## hydrates only current_temperature (dim 0), and *#4*#0## returns only global plant mode (*4*202*#0##) + operational flags (21, 22, 24, 210) — leaving target_temperature (dim 12 / dim 14) as None until a manual setpoint change occurs.
2. Out-of-band offline drift: setpoint or room-knob (dim 13) adjustments made on the 3550 or room probe while Home Assistant was offline are not observed by *#4*Z*0##.

Evidence (Firmware Oracle + Physical Traces)

• QEMU Firmware Oracle (trace-corpus.tsv for *#4*1##): F450, F453, F453AV, F454, F459, H4684, MH200, MH200N, and MH202 do not drop *#4*Z## or hang the TCP socket for 10 s. All 9 expand *#4*1## onto the SCS bus into the 4 dimension queries ($0499013000 temp, $0499013012 effective setpoint + mode, $049901300E nominal setpoint, $049901300D local offset) and close the command session cleanly (ACK on MH202; ~1.5-2.0 s NACK if unanswered on the other 8). Only F455 (F455 multiple timeouts #674, not in the oracle) hung the TCP socket for 10 s on actuator-only channels (*#4*Z*19*0*0##).
• Physical F454 + 3550 Central Unit Trace (tests/fixtures/traces/issue_629/home-assistant_myhome_2026-10-05T11-16-10.935Z.cleaned.log, lines 489-700): all 12 subordinate zones (*#4*1##..*#4*15##) completed in ~1.3 s each (Message *#4*Z## was successfully sent), returning all 5 frames (*#4*Z*0*...##, *#4*Z*12*...##, *4*202*Z##, *#4*Z*14*...##, *#4*Z*13*...##).

Proposed Design & Guardrails

1. Require live #0 confirmation on the event session (never #0#1):
   • MyHOMEClimate.__init__ currently sets gateway.has_central_unit = True for both #0 (99-zone 3550) and #0#1 (4-zone 4695), and sets it from restored registry entries before the bus has spoken.
   • Track live confirmation (gateway.central_unit_0_confirmed = True) only when an inbound frame from WHERE == "#0" arrives on evt (e.g. #0's ~0.17 s reply to *#4*#0## or its first broadcast).
2. Handle Day-0 discovery ordering (zones discovered before #0):
   • Because *#4*0## is omitted on these gateways and MyHOMEEntity._attr_should_poll = False, room probes discovered before #0 broadcasts have already consumed their single _poll_on_add cycle while #0 was still unknown.
   • When central_unit_0_confirmed transitions to True on a non-F455 gateway, dispatch a one-shot informational *#4*Z## for registered subordinate zones (not zone._central, not zone._standalone) whose target_temperature is still None (and use *#4*Z## for cold subordinate zones discovered thereafter).
3. Keep the poll informational & interface-safe:
   • Do not attach ZonePollHealth (_poll_answered) so mixed plants with actuator-only channels (*#4*Z*19*0*0##) or un-enrolled zones do not raise false unresponsive_zone repairs on NACK.
   • Strictly honor interface_zone_request_refused on Z#4#II addresses (notably MH202, where own-firmware-oracle#60 shows *#4*2#4#01## crashes bt_termo).
4. Evaluate targeted zone refresh in myhome.sweep_bus:
   • When myhome.sweep_bus (force=False) skips *#4*0##, consider refreshing known climate zones using the gateway's active per-zone poll strategy so sweep_bus still refreshes WHO 4 state.