ci(interop): one-command external-validation suite + CI lanes for the daemon

tools/run_interop.sh runs ALL nine validation steps with a PASS/FAIL summary:
build, unit (464), daemon-unit (41), secsgem-py host vs server (31 checks),
secs_conformance (47), gRPC+secsgem-py daemon bridge, spool persistence
across restart, tshark HSMS dissector, secs4java8 (55 checks). Verified green
end-to-end. The unit suite is partly self-referential (our parsers validate
our builders); these external validators are the real oracle — now they run
with one command instead of by hand. Two bugs found by running it: unbounded
ninja at -O3 OOM-kills cc1plus in memory-constrained Docker VMs (build with
-j 2) and bash-3.2 lacks negative array subscripts.

CI: grpc deps added to the build job so secs_gemd + secs_gemd_tests build and
RUN in CI (previously the daemon silently dropped out — now fails loudly if
missing), plus a python-interop lane running py-host/conformance/daemon
harnesses against localhost in one container (no docker-in-docker).

Service hardening while in there: reject proto Values with no kind set at
the RPC edge (previously silently became ASCII ""), TODO markers for list
element formats and daemon graceful shutdown. New tests: unset-Value guard
+ a property test iterating ALL configured variables via gRPC asserting each
keeps its declared SECS-II format (daemon tests 16 -> 41 assertions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/equipment_service.hpp

@@ -59,15 +59,25 @@ inline s2::Item to_item(const pb::Value& v, s2::Format want) {
       }
     }
     case pb::Value::kList: {
+      // TODO(daemon): list elements inherit the variable's scalar format;
+      // honouring per-element formats needs the declared Item's nested shape.
       s2::Item::List items;
       for (const auto& e : v.list().items()) items.push_back(to_item(e, want));
       return s2::Item::list(std::move(items));
     }
     default:
+      // Unreachable: callers reject KIND_NOT_SET before converting (see
+      // value_is_set). Kept as a safe fallback for future oneof additions.
       return s2::Item::ascii("");
   }
 }
 
+// Validate a client-supplied Value before conversion. An unset oneof would
+// otherwise silently become ASCII "" — reject it at the API edge instead.
+inline bool value_is_set(const pb::Value& v) {
+  return v.kind_case() != pb::Value::KIND_NOT_SET;
+}
+
 inline pb::ControlState::State to_proto_state(gem::ControlState s) {
   switch (s) {
     case gem::ControlState::EquipmentOffline: return pb::ControlState::EQUIPMENT_OFFLINE;
@@ -101,6 +111,11 @@ class EquipmentService final : public pb::Equipment::Service {
         resp->set_message("no variable named '" + kv.first + "'");
         return grpc::Status::OK;
       }
+      if (!value_is_set(kv.second)) {
+        resp->set_code(pb::Ack::PARAMETER_INVALID);
+        resp->set_message("value for '" + kv.first + "' has no kind set");
+        return grpc::Status::OK;
+      }
       rt_.set_variable(it->second.vid, to_item(kv.second, it->second.format));
     }
     resp->set_code(pb::Ack::ACCEPT);
@@ -117,6 +132,11 @@ class EquipmentService final : public pb::Equipment::Service {
         resp->set_message("no variable named '" + kv.first + "'");
         return grpc::Status::OK;
       }
+      if (!value_is_set(kv.second)) {
+        resp->set_code(pb::Ack::PARAMETER_INVALID);
+        resp->set_message("value for '" + kv.first + "' has no kind set");
+        return grpc::Status::OK;
+      }
       rt_.set_variable(it->second.vid, to_item(kv.second, it->second.format));
     }
     auto ev = events_.find(req->name());