canbus: decode the water-heater DSI fault + add fault binary_sensors

Forced a real lockout (captures/dsi-fault-*.log) and diffed vs the healthy
baseline:
- Water-heater DSI fault = node 95 page-3 b0 bit5 (0x20). Healthy 0x80/0x81,
  fault 0xA0. (Earlier suspects b1=FF and node AE were both wrong.)
- Bus-wide "system fault present" = page-0 b0 bit0 (every node flips 02->03).

Both wired into esphome/onecontrol-canbus.yaml as binary_sensor (device_class:
problem). README + HANDOFF updated; DSI item closed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

canbus/HANDOFF.md

@@ -60,10 +60,11 @@ state + what's left.
    opcode. The node allowlist is **lights only** — keep movement nodes
    (awning/slides/jacks, type `0x21`) off the switch list until a careful
    attended first test.
-6. **DSI fault `binary_sensor`** — see the section below (pending a capture).
-7. **(Optional) Surface at the campsite HA + bridge home** like the gazebo fans /
+6. **(Optional) Surface at the campsite HA + bridge home** like the gazebo fans /
    OneControl BLE devices, if you want these in the home dashboard too.
 
+The DSI fault is already decoded and wired in (see below) — no capture needed.
+
 ## File map
 
 | File | What it is |
@@ -86,18 +87,12 @@ state + what's left.
 - One transceiver = one bus-end terminator. Never add a terminated node in the
   middle of the bus (would make three terminators).
 
-## DSI fault — PENDING a fault capture
+## DSI fault — DECODED (2026-06-12)
 
-> The water-heater DSI (gas ignition) fault is almost certainly on the bus, but
-> every capture so far is of a healthy heater, so the exact byte is unknown.
->
-> **Capture plan (this session):** close the propane valve, run the water heater
-> on gas until it locks out (DSI fault light on the panel), capture ~20 s, and
-> diff against a healthy baseline (`captures/baseline-2026-06-11_223823.log`).
-> Prime suspects (both sit at a constant "all-clear" value today):
-> - node `95` (heater) page-3 `b1` — always `0xFF`; expect a bit to drop on fault.
-> - node `AE` (type 0x27, ?LP-gas/diagnostics) page-3 — always `0x00`; expect non-zero on fault.
->
-> **TODO once decoded:** record the node/page/byte/bit here, then add a
-> `binary_sensor` to the YAML (`device_class: problem`) that reads it — the DSI
-> fault the Bluetooth app never exposed.
+Forced a real lockout and captured it (`captures/dsi-fault-*.log`). Already wired
+into the YAML as two `binary_sensor`s; nothing left to do here.
+
+- **Water Heater DSI Fault** = node `95` page-3 `b0` bit5 (`0x20`). Healthy heater
+  = `0x80` off / `0x81` running; lockout = `0xA0`.
+- **OneControl System Fault** = page-0 `b0` bit0 (`0x01`), a bus-wide
+  "fault exists somewhere" flag (read from node `95`'s page 0 in the lambda).