Hurco KM3P retrofit

OK, those were wired to the limit switches for sure, and should be wired back.
Sorry for being blunt, but you mentioned 7i93 twice, and you mentioned PWM and using ABS in hal, so that threw me off.
You do not need dir pins for +-10V controls, just wire back the RAC and FAC to the limit switches, they must be ON (connected to 15V) when limits are not triggered.

What are the chances of one of the limit switches being faulty or miss wired? The switches should have 4 wires, 2 for normally open and 2 for normally closed, the normally closed ones should go to the drive.
If you wire RAC and FAC to the switches, do both wires give 15V at the drive?

I suspect that there will be problems rigging up FAC and RAC to anything in HAL, as a servo system naturally dithers when stationary. Certainly don't try using an electromechanical relay.

PWM and DIR of Mesa analogue outputs are not obviously available, but can be found. If you start LinuxCNC from the command-line you will get a listing of the Mesa card pin allocations. You can then see which GPIO pin has been allocated to the DIR line, and use that. Something like hm2_5i24.0.gpio-0000-out

But, a better plan might be to use a "wcomp" on the output of the pid component, and then drive each of FAC and RAC with the under and over outputs with the min and max set slightly below and above zero to leave a small anti-dither window around zero.
linuxcnc.org/docs/stable/html/man/man9/wcomp.9.html