canbus: decode the water-heater DSI fault + add fault binary_sensors

Forced a real lockout (captures/dsi-fault-*.log) and diffed vs the healthy
baseline:
- Water-heater DSI fault = node 95 page-3 b0 bit5 (0x20). Healthy 0x80/0x81,
  fault 0xA0. (Earlier suspects b1=FF and node AE were both wrong.)
- Bus-wide "system fault present" = page-0 b0 bit0 (every node flips 02->03).

Both wired into esphome/onecontrol-canbus.yaml as binary_sensor (device_class:
problem). README + HANDOFF updated; DSI item closed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

canbus/esphome/onecontrol-canbus.yaml

@@ -132,10 +132,21 @@ canbus:
                   // switched loads
                   case 0xF8: id(interior_lights).publish_state(x[0] & 0x01); break;
                   case 0x2A: id(exterior_lights).publish_state(x[0] & 0x01); break;
-                  // TODO: water pump (61), water heater (95) once exposed below.
+                  // water heater (node 95): b0 bit0 = on, bit5 (0x20) = DSI/gas
+                  // ignition fault/lockout (healthy: 0x80 off / 0x81 running;
+                  // fault: 0xA0). Confirmed by a forced lockout 2026-06-12.
+                  case 0x95: id(dsi_fault).publish_state(x[0] & 0x20);  break;
+                  // TODO: water pump (61) on/off once exposed below.
                 }
               }
 
+              // page 0 b0 bit0 = a bus-wide "system fault present" flag (every
+              // node mirrors it; healthy 0x02, fault 0x03). Read it from one node
+              // (the heater) so we publish a single source, not 14 duplicates.
+              if (page == 0 && node == 0x95 && x.size() >= 1) {
+                id(system_fault).publish_state(x[0] & 0x01);
+              }
+
               // Battery voltage rides 29-bit telemetry frames (src 7D/AE, page
               // 0x11), payload 00 2B 0D 4x ..; b2..b3 (BE) / 256 = volts.
               // TODO: match the exact source frame and publish battery_voltage.
@@ -236,6 +247,19 @@ sensor:
     unit_of_measurement: "%"
     accuracy_decimals: 0
 
+# ---------------------------------------------------------------------------
+# Fault indicators (published by the dispatcher above)
+# ---------------------------------------------------------------------------
+binary_sensor:
+  - platform: template
+    name: "Water Heater DSI Fault"
+    id: dsi_fault
+    device_class: problem      # node 95 page-3 b0 bit5 — gas ignition lockout
+  - platform: template
+    name: "OneControl System Fault"
+    id: system_fault
+    device_class: problem      # page-0 b0 bit0 — bus-wide "a fault exists"
+
 # ---------------------------------------------------------------------------
 # Switches — authenticated command path (see send_load_command above).
 # Each turn_on/off queues send_load_command for the load's node; the on_frame