ci(interop): one-command external-validation suite + CI lanes for the daemon

tools/run_interop.sh runs ALL nine validation steps with a PASS/FAIL summary:
build, unit (464), daemon-unit (41), secsgem-py host vs server (31 checks),
secs_conformance (47), gRPC+secsgem-py daemon bridge, spool persistence
across restart, tshark HSMS dissector, secs4java8 (55 checks). Verified green
end-to-end. The unit suite is partly self-referential (our parsers validate
our builders); these external validators are the real oracle — now they run
with one command instead of by hand. Two bugs found by running it: unbounded
ninja at -O3 OOM-kills cc1plus in memory-constrained Docker VMs (build with
-j 2) and bash-3.2 lacks negative array subscripts.

CI: grpc deps added to the build job so secs_gemd + secs_gemd_tests build and
RUN in CI (previously the daemon silently dropped out — now fails loudly if
missing), plus a python-interop lane running py-host/conformance/daemon
harnesses against localhost in one container (no docker-in-docker).

Service hardening while in there: reject proto Values with no kind set at
the RPC edge (previously silently became ASCII ""), TODO markers for list
element formats and daemon graceful shutdown. New tests: unset-Value guard
+ a property test iterating ALL configured variables via gRPC asserting each
keeps its declared SECS-II format (daemon tests 16 -> 41 assertions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/secs_gemd.cpp

@@ -68,6 +68,10 @@ int main(int argc, char** argv) {
   }
   std::cout << "[gemd] gRPC on " << grpc_addr
             << "; HSMS equipment on :" << hsms_port << std::endl;
+  // TODO(daemon): graceful shutdown — handle SIGTERM/SIGINT by calling
+  // server->Shutdown() and rt->stop() so in-flight RPCs drain and the spool
+  // journal flushes, instead of dying mid-write when supervised (systemd/
+  // docker stop). See DAEMON_ROADMAP Phase E.
   server->Wait();
   return 0;
 }