verify: secs4j cross-validation (independent Java implementation)

20 cross-validation checks PASS against [secs4java8] (Apache 2.0,
kenta-shimizu) — an independent SECS/HSMS implementation in Java by
a different author from a different language ecosystem.  Distinct
implementer = independent spec interpretation.  Two libraries
agreeing on wire bytes is much stronger evidence of spec-correctness
than either alone.

Coverage targets the gap the secsgem-py interop deliberately skipped
(secsgem-py's SFDL grammar couldn't easily express GEM 300 bodies
with variable lists of named scalars):

  - S1F1/F13/F17/F19/F21/F23 — establish comms + namelists
  - S2F17 — clock
  - S2F23 — trace init (5-field body)
  - S2F49 — enhanced remote command (DATAID + OBJSPEC + RCMD + params)
  - S3F17/F19/F25/F27 — full E87 carrier surface (action, slot map
                        verify, transfer with port pair, cancel)
  - S5F13/F17 — exception recovery (EXID + EXRECVRA)
  - S14F9/F11 — E94 CJ create with prjobids list, CJ delete
  - S16F5/F27 — E40 PJ command, E94 CJ command
  - S1F15 — offline cleanup

20/20 PASS against the demo equipment.  Reply S/F matches the spec
for every transaction; specific ACK values vary by equipment state
(CarrierIDUnknown for an unknown carrier is just as valid as Accept
for a known one) so we assert on the wire shape, not the result.

Ship layout:
  interop/secs4j/Dockerfile          — eclipse-temurin:21-jdk + clone
                                       + build of secs4java8 → Export.jar
  interop/secs4j/Secs4jHostHarness.java
                                     — 20 round_trip assertions; uses
                                       Secs2.list/uint4/ascii to build
                                       full GEM 300 bodies; comm.send()
                                       for arbitrary S/F pairs
  interop/secs4j_validate.sh         — orchestrator: builds image,
                                       compiles harness, starts compose
                                       server, runs Java container on
                                       the secs network against it
  .gitea/workflows/ci.yml            — secs4j-interop job in CI
  README.md                          — proof table grows to 7 commands
  .gitignore                         — *.class

After this commit our proof chain has:
  - SEMI E5 KAT          (standards body's own arithmetic)
  - tshark dissector     (Wireshark's HSMS impl)
  - secsgem-py interop   (Python reference impl)
  - **secs4j interop**   (independent Java impl)
  + 426 unit tests, 47 conformance harness checks, 100k random ops,
    YAML validation

Four independent external proofs, three of them on overlapping wire
surface from independent angles.

Plan: VERIFICATION.md §3.

[secs4java8]: https://github.com/kenta-shimizu/secs4java8

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

interop/secs4j_validate.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Orchestrate the secs4java8 interop harness against our C++ server.
+#
+# Boots secs_server on the docker bridge, then runs the Java harness
+# in its own container against it.  Wired into CI via a separate
+# job (see .gitea/workflows/ci.yml).
+#
+# Usage: bash interop/secs4j_validate.sh
+# Exit codes:
+#   0 — every check the harness defines passed
+#   1 — one or more checks failed
+#   2 — script / orchestration error
+set -euo pipefail
+
+PORT=${PORT:-5099}
+
+cd "$(dirname "$0")/.."
+
+# Ensure the secs4j-interop image is built (idempotent).
+echo "ensuring secs4j-interop image is built..."
+docker build -t secsgem-secs4j-interop -f interop/secs4j/Dockerfile interop/secs4j \
+    >/dev/null 2>&1
+
+# Ensure the harness is compiled.
+echo "compiling Secs4jHostHarness.java..."
+docker run --rm -v "$PWD/interop/secs4j:/work" secsgem-secs4j-interop \
+    bash -c "cd /work && javac -cp /opt/secs4java8/Export.jar Secs4jHostHarness.java" \
+    || { echo "FAIL: javac"; exit 2; }
+
+# Start the C++ server in background on the compose bridge network so
+# the secs4j container can DNS-resolve it.
+echo "starting secs_server (compose)..."
+docker compose up -d server >/dev/null 2>&1
+trap 'docker compose stop server >/dev/null 2>&1 || true' EXIT
+
+# Give the server a moment to bind.
+sleep 1
+
+# Run the harness on the same compose network as the server, against
+# the compose-defined hostname "server" on port 5000 (the demo
+# server's default).
+echo "running Secs4jHostHarness..."
+docker run --rm \
+    --network secs-gem_secs \
+    -v "$PWD/interop/secs4j:/work" \
+    secsgem-secs4j-interop \
+    java -cp /opt/secs4java8/Export.jar:/work Secs4jHostHarness server 5000
+
+# trap handles teardown.