canbus: expose water heater + awning; block water pump

Per updated policy:
- Water heater (node 95): new switch entity + on/off state read-back.
- Awning (node 75): new cover entity (open=op01 / close=op02 / stop=op00), with
  current_operation published from the page-3 motion byte (C2/C3/C0). First
  actuation must be attended; single-shot commands can't run the motor away.
- Water pump (node 61): added to command_guard denylist (winterizing-only,
  panel/app only) alongside slides/jacks. Guard re-tested 8/8 (host g++).

Switch/cover comments + HANDOFF safety notes and remaining-work updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

canbus/HANDOFF.md

@@ -55,12 +55,16 @@ state + what's left.
      publish `battery_voltage`. (See README "29-bit extended frames".)
    - Optionally add **water pump (`61`)** and **water heater (`95`)** — both are
      ordinary switched loads, same decode + command path as the lights.
-5. **Verify the command path** from HA: toggle Interior/Exterior Lights. The
-   `send_load_command` script + `on_frame` handler do the exchange and send the
-   opcode. The node allowlist is **lights only** — keep movement nodes
-   (awning/slides/jacks, type `0x21`) off the switch list until a careful
-   attended first test.
-6. **(Optional) Surface at the campsite HA + bridge home** like the gazebo fans /
+5. **Verify the command path** from HA: toggle Interior/Exterior Lights and the
+   Water Heater. The `send_load_command` script + `on_frame` handler do the
+   exchange and send the opcode.
+6. **Attended awning test (motor — watch it move).** The Awning `cover` is wired
+   (open/close/stop). On the first run, confirm: (a) which direction open/close
+   actually go, (b) whether one command runs to the travel limit or only moves
+   while commands stream. If it under-travels, change `send_load_command` to
+   stream the opcode (repeat until Stop) — only after watching it. The single-shot
+   default can't run the motor away.
+7. **(Optional) Surface at the campsite HA + bridge home** like the gazebo fans /
    OneControl BLE devices, if you want these in the home dashboard too.
 
 The DSI fault is already decoded and wired in (see below) — no capture needed.
@@ -80,18 +84,22 @@ The DSI fault is already decoded and wired in (see below) — no capture needed.
 
 ## Safety notes
 
-- **SLIDES AND JACKS ARE CONTROL-PANEL ONLY — never over CAN. This is a hard
-  rule, do not weaken it.** `esphome/command_guard.h` (`command_blocked()`) is the
-  single source of truth: it refuses any motor-class (0x21) node other than the
-  awning, via an explicit slide/jack denylist (6A/7F/9C, effective even before a
-  node's identity is heard) *and* a general class check. It's enforced in two
-  independent places — the command-entry script and the actual transmit point —
-  so loosening one does not open the other. Adding a slide/jack switch entity
-  cannot actuate it; the gate drops the command before any frame goes out.
-- **Command path is otherwise lights-only by allowlist.** The awning is permitted
-  by the safety gate but intentionally left unwired (operate it from the panel).
-  To expose any new switched load, add its node to the layer-2 allowlist in
-  `send_load_command`; never add a slide/jack.
+- **SLIDES, JACKS, and the WATER PUMP ARE PANEL/APP ONLY — never over CAN. This
+  is a hard rule, do not weaken it.** `esphome/command_guard.h`
+  (`command_blocked()`) is the single source of truth: it refuses the slide/jack
+  nodes (6A/7F/9C, effective even before a node's identity is heard), the water
+  pump (61, winterizing-only), and — generally — any motor-class (0x21) node other
+  than the awning. It's enforced in two independent places (the command-entry
+  script and the actual transmit point), so loosening one does not open the other.
+  Wiring a switch for a blocked node cannot actuate it; the gate drops the command
+  before any frame goes out.
+- **Exposed (controllable) loads:** exterior lights (2A), interior lights (F8),
+  water heater (95) as `switch`es, and the awning (75) as a `cover`. To expose
+  another *permitted* switched load, add its node to the layer-2 allowlist in
+  `send_load_command` and add a `switch` entity; never add a slide/jack/pump.
+- **The awning is a motor — its first actuation must be attended** (see
+  remaining-work item 6). The wired commands are single-shot, which can't run the
+  motor away, but direction and latch-vs-stream behavior need a live check.
 - The physical connection is fully reversible: unplug, re-seat the terminator.
 - One transceiver = one bus-end terminator. Never add a terminated node in the
   middle of the bus (would make three terminators).