ci(interop): one-command external-validation suite + CI lanes for the daemon

tools/run_interop.sh runs ALL nine validation steps with a PASS/FAIL summary:
build, unit (464), daemon-unit (41), secsgem-py host vs server (31 checks),
secs_conformance (47), gRPC+secsgem-py daemon bridge, spool persistence
across restart, tshark HSMS dissector, secs4java8 (55 checks). Verified green
end-to-end. The unit suite is partly self-referential (our parsers validate
our builders); these external validators are the real oracle — now they run
with one command instead of by hand. Two bugs found by running it: unbounded
ninja at -O3 OOM-kills cc1plus in memory-constrained Docker VMs (build with
-j 2) and bash-3.2 lacks negative array subscripts.

CI: grpc deps added to the build job so secs_gemd + secs_gemd_tests build and
RUN in CI (previously the daemon silently dropped out — now fails loudly if
missing), plus a python-interop lane running py-host/conformance/daemon
harnesses against localhost in one container (no docker-in-docker).

Service hardening while in there: reject proto Values with no kind set at
the RPC edge (previously silently became ASCII ""), TODO markers for list
element formats and daemon graceful shutdown. New tests: unset-Value guard
+ a property test iterating ALL configured variables via gRPC asserting each
keeps its declared SECS-II format (daemon tests 16 -> 41 assertions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/DAEMON_ROADMAP.md

@@ -92,11 +92,14 @@ debts tax every later phase, and the most valuable tests aren't automated.
    (WatchHealth foundation). ⬜ Remaining: roll the same 3-line pattern onto the
    other single-slot classes (comm-state, EPT, exceptions, substrates, modules,
    carriers, E84) as each phase needs them — mechanical now that the type exists.
-2. ⬜ **CI the interop + conformance harnesses** (`tools/run_interop.sh` + lane:
-   host_vs_cpp_server, daemon_interop, secs4j, tshark, secs_conformance). The
-   unit suite is partly self-referential (our parsers validate our builders);
-   the external validators are the real oracle and currently run only by hand.
-   Highest leverage-per-effort item in the repo.
+2. 🚧 **CI the interop + conformance harnesses.** `tools/run_interop.sh` ✅ —
+   one command runs ALL nine validation steps (build, unit, daemon-unit,
+   py-host 31 checks, conformance 47, daemon bridge, spool restart, tshark,
+   secs4j 55) with a PASS/FAIL summary; verified green end-to-end 2026-06-10.
+   CI ✅ added but UNVERIFIED until pushed: grpc deps + `secs_gemd_tests` in
+   the build job (fails loudly if the daemon silently drops out), and a new
+   `python-interop` lane (py-host + conformance + daemon harness against
+   localhost, no docker-in-docker). ⬜ Verify the lanes on the first push.
 3. ✅ **Fix `CompleteCommand` proto comment** — it described the rejected
    blocking model; now states the HCACK-4 contract.
 4. ⬜ **Table-driven handler conformance test** ((request, expected-reply-shape)
@@ -113,9 +116,11 @@ debts tax every later phase, and the most valuable tests aren't automated.
 7. ⬜ Move `apps/equipment_service.hpp` into the library tree
    (`include/secsgem/daemon/`) once Phase B grows it; add a TSan-built
    `run_async` + concurrent-RPC daemon test (today's daemon tests only poll()).
-8. ⬜ Validate names are identifier-safe in `ConfigValidator` (the Python
-   client's kwargs API depends on it); generalize the format-compliance test
-   to iterate ALL configured variables (property-style, same cost).
+8. 🚧 Validate names are identifier-safe in `ConfigValidator` (the Python
+   client's kwargs API depends on it) — ⬜. Generalized format-compliance
+   property test (iterates ALL configured variables via gRPC, asserts each
+   keeps its declared wire format) — ✅, plus an unset-`Value` guard at the
+   RPC edge (was silently writing ASCII "").
 
 ### Phase A — finish the universal daemon surface (small, unblock vendors)
 1. ⬜ `GetVariables` — needs the reverse `Item → proto Value` conversion