CANopen Safety: reconcile the CiA 304 implementation against EN 50325-5:2010 / CiA 304 V1.1 #289

CANopen Safety (CiA 304) is being built against CiA DSP 304 V1.0 (01.01.2001), the only full text available (docs/reviews/2026-10-09-canopen-safety-scope.md, decision 2). CiA 304 V1.1 (April 2003) is withdrawn with the note "Content moved to EN 50325-5:2010", and neither text is in the repository.

Once EN 50325-5:2010 (or CiA 304 V1.1) is available, reconcile the implementation against it. Known points where V1.0 leaves a choice that the implementation had to make:

• CRC 13FFh: V1.0 names only the polynomial x^16 + x^12 + x^5 + 1. Chosen: initial value 0000h, no reflection, no xor-out (CRC-16/XMODEM, as the SDO block transfer), multi-byte fields MSB-first in the order D(x) lists them (§8.4.2.2).
• 13FFh access: Table 6 says ro, the entry description says rw. Chosen: rw for sub 1..n (§9.2 has the tool write the checksums), sub0 ro.
• Defaults and value ranges of 1301h–1340h, 1381h–13C0h, 13FEh; whether 1.1 / EN 50325-5 add objects or change the SRDO mapping record (pairs of plain / inverted entries).
• GFC (§8.2): whether 1300h gates reception as well as transmission, and the DLC rule.
• Timing rules (§8.1.1, §9.5): first cyclic transmission delayed 0.5 ms × node-id; SRVT/SCT semantics.

Anything that differs is a fix(canopen) against the norm text, with the section cited in the commit.