CANopen: collected minor findings (boundary OOM, registration leak, RTR DLC, doc drift)

[dborgards]

Minor findings from section 3 of the repository review, CANopen part. Source: docs/reviews/2026-09-10-repository-review.md (branch claude/repository-review-hpttwc). Line numbers refer to main @ 8ed80f6.

• A transfer of exactly MaxSdoTransferBytes fails with OutOfMemory (SdoBlock.cs:387-405) — an off-by-one on the boundary the option names.
• The per-operation CancellationTokenRegistration is never disposed (CanOpenNode.cs:1271-1282); same shape as J1939-TP: the per-send CancellationTokenRegistration is never disposed #36.
• blksize == 0 is silently replaced with the default instead of aborting, though CiA 301 defines 0 as invalid.
• Node guarding sends its RTR with DLC 0 (NodeGuarding.cs:112); CiA 301 asks for DLC 1.
• Our own echo frames are not filtered, so a node can start itself from its own NMT broadcast. Related: RawCan: subscriptions cannot tell an echo from a received frame #23.
• SdoAbortException uses ProtocolPeerAbort for local timeouts too, so a caller cannot tell "the peer aborted" from "we gave up".
• In NMT Stopped the SDO server discards requests, but sessions, SYNC and EMCY keep running — the state is applied in one place and not the others.
• About ten doc/behaviour drifts in the XML comments: ICanOpenNode.cs:42-44, :60-62, NmtState.cs:4-6, and ObjectDictionary.cs:7 claims "thread-safe" while OdEntry.cs:83-92 reads without synchronization.