ci(interop): one-command external-validation suite + CI lanes for the daemon

tools/run_interop.sh runs ALL nine validation steps with a PASS/FAIL summary:
build, unit (464), daemon-unit (41), secsgem-py host vs server (31 checks),
secs_conformance (47), gRPC+secsgem-py daemon bridge, spool persistence
across restart, tshark HSMS dissector, secs4java8 (55 checks). Verified green
end-to-end. The unit suite is partly self-referential (our parsers validate
our builders); these external validators are the real oracle — now they run
with one command instead of by hand. Two bugs found by running it: unbounded
ninja at -O3 OOM-kills cc1plus in memory-constrained Docker VMs (build with
-j 2) and bash-3.2 lacks negative array subscripts.

CI: grpc deps added to the build job so secs_gemd + secs_gemd_tests build and
RUN in CI (previously the daemon silently dropped out — now fails loudly if
missing), plus a python-interop lane running py-host/conformance/daemon
harnesses against localhost in one container (no docker-in-docker).

Service hardening while in there: reject proto Values with no kind set at
the RPC edge (previously silently became ASCII ""), TODO markers for list
element formats and daemon graceful shutdown. New tests: unset-Value guard
+ a property test iterating ALL configured variables via gRPC asserting each
keeps its declared SECS-II format (daemon tests 16 -> 41 assertions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -35,6 +35,10 @@ jobs:
             ninja-build \
             libasio-dev \
             libyaml-cpp-dev \
+            libprotobuf-dev \
+            protobuf-compiler \
+            protobuf-compiler-grpc \
+            libgrpc++-dev \
             python3 \
             python3-yaml
 
@@ -47,6 +51,14 @@ jobs:
       - name: Unit tests (Release)
         run: build/secsgem_tests
 
+      # The daemon's gRPC service tests (in-process channel). The grpc deps
+      # above make secs_gemd_tests build; fail loudly if it didn't, so the
+      # daemon can never silently drop out of CI again.
+      - name: Daemon tests (Release)
+        run: |
+          test -x build/secs_gemd_tests || { echo "secs_gemd_tests not built"; exit 1; }
+          build/secs_gemd_tests
+
   thread-sanitizer:
     runs-on: ubuntu-latest
     container:
@@ -176,6 +188,78 @@ jobs:
       - name: secs4j cross-validation
         run: bash interop/secs4j_validate.sh
 
+  python-interop:
+    # secsgem-py (the Python reference implementation) judging our wire
+    # behaviour: its GemHostHandler drives our secs_server (31 checks), the
+    # C++ conformance host drives it too (47 checks), and the dual-face
+    # daemon harness (gRPC tool + secsgem-py host vs secs_gemd) proves the
+    # gRPC<->HSMS bridge. Localhost processes in one container — no
+    # docker-in-docker.
+    runs-on: ubuntu-latest
+    container:
+      image: ubuntu:24.04
+    steps:
+      - name: Bootstrap (node + git for actions/checkout)
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git ca-certificates nodejs
+
+      - uses: actions/checkout@v4
+
+      - name: Install toolchain + python
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get install -y --no-install-recommends \
+            build-essential cmake ninja-build \
+            libasio-dev libyaml-cpp-dev \
+            libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
+            python3 python3-yaml python3-venv python3-pip
+
+      - name: Build
+        run: |
+          cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
+          cmake --build build
+
+      - name: Python deps (secsgem-py + grpcio, same pins as interop image)
+        run: |
+          python3 -m venv /tmp/venv
+          /tmp/venv/bin/pip install --no-cache-dir \
+            secsgem==0.3.0 grpcio==1.60.0 grpcio-tools==1.60.0 "setuptools<80"
+
+      - name: secsgem-py host vs secs_server
+        run: |
+          build/secs_server --port 5001 &
+          SERVER=$!
+          sleep 1
+          /tmp/venv/bin/python interop/host_vs_cpp_server.py --host 127.0.0.1 --port 5001
+          rc=$?
+          kill $SERVER 2>/dev/null || true
+          exit $rc
+
+      - name: secs_conformance vs secs_server
+        run: |
+          build/secs_server --port 5002 &
+          SERVER=$!
+          sleep 1
+          build/secs_conformance --host 127.0.0.1 --port 5002
+          rc=$?
+          kill $SERVER 2>/dev/null || true
+          exit $rc
+
+      - name: daemon interop (gRPC tool + secsgem-py host vs secs_gemd)
+        run: |
+          build/secs_gemd --port 5003 --grpc 127.0.0.1:50051 &
+          GEMD=$!
+          sleep 1
+          /tmp/venv/bin/python interop/daemon_interop.py \
+            --grpc 127.0.0.1:50051 --hsms-host 127.0.0.1 --hsms-port 5003 \
+            --proto-dir proto/secsgem/v1
+          rc=$?
+          kill $GEMD 2>/dev/null || true
+          exit $rc
+
   libfuzzer:
     runs-on: ubuntu-latest
     container: