feat(daemon): Phase E — production hardening, complete

Exposure: --grpc default flipped from 0.0.0.0 to 127.0.0.1 (the API is
unauthenticated by design; auth belongs to the transport), Unix-domain-
socket support (--grpc unix:///run/secs_gemd/api.sock = zero network
surface), SECURITY.md documents the contract and ch42 gained a "Running it
in production" section (which also documents the HSMS-SS single-session
assumption).

Graceful shutdown: SIGTERM/SIGINT land on an asio::signal_set on the io
thread, which nudges grpc Shutdown with a 2s deadline (cancels open
Subscribe/WatchHealth streams); Wait() returns on the MAIN thread, which
stops the engine (rt->stop() joins the io thread, so it must not run on
it). Exit 0, journal-safe, the in-code TODO is gone. --spool-dir added so
host-bound events survive daemon restarts.

Observability: --metrics serves Prometheus gauges secsgem_link_selected /
secsgem_control_state / secsgem_spool_depth, wired via the Phase-0
add_link_observer/add_control_state_observer hooks + io-thread sampling.

Deployment: deploy/secs_gemd.service — hardened systemd unit (DynamicUser,
ProtectSystem=strict, StateDirectory for the spool, UDS for the API,
TimeoutStopSec aligned with the graceful-shutdown window).

Enforcement: tools/check_daemon_ops.sh proves all three operational claims
(unix-socket gRPC accepts, all gauges present on /metrics, SIGTERM -> exit
0 + clean-stop log) — green; wired into tools/run_interop.sh (now 11
steps) and CI. CI python-interop lane also gained the pyclient and
spool-restart steps, so every harness now runs in CI.

TODO sweep: the shutdown TODO is fixed; the four remaining TODOs (nested
list formats, C2-as-text, U8>2^63, CONNECTED link state) are deliberate
deferred edge cases, each marked in code with context.

Daemon suite re-verified green (175 assertions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -279,6 +279,42 @@ jobs:
           kill $GEMD 2>/dev/null || true
           exit $rc
 
+      - name: Python client package vs secs_gemd
+        run: |
+          /tmp/venv/bin/python clients/python/tests/test_values.py
+          build/secs_gemd --port 5005 --grpc 127.0.0.1:50052 &
+          GEMD=$!
+          sleep 1
+          PYTHONPATH=clients/python /tmp/venv/bin/python interop/pyclient_interop.py \
+            --grpc 127.0.0.1:50052 --hsms-host 127.0.0.1 --hsms-port 5005
+          rc=$?
+          kill $GEMD 2>/dev/null || true
+          exit $rc
+
+      - name: spool persistence across a server restart
+        run: |
+          set -e
+          SPOOL=$(mktemp -d)
+          build/secs_server --port 5006 --spool-dir "$SPOOL" &
+          SRV=$!
+          sleep 1
+          /tmp/venv/bin/python interop/spool_persistence_test.py \
+            --phase enqueue --host 127.0.0.1 --port 5006
+          kill $SRV; wait $SRV 2>/dev/null || true
+          build/secs_server --port 5006 --spool-dir "$SPOOL" &
+          SRV=$!
+          sleep 1
+          /tmp/venv/bin/python interop/spool_persistence_test.py \
+            --phase drain --host 127.0.0.1 --port 5006
+          rc=$?
+          kill $SRV 2>/dev/null || true
+          exit $rc
+
+      # Phase E operational contract: unix-socket gRPC, Prometheus gauges,
+      # graceful SIGTERM shutdown (exit 0, journal-safe).
+      - name: daemon ops (unix socket + metrics + graceful shutdown)
+        run: bash tools/check_daemon_ops.sh
+
   libfuzzer:
     runs-on: ubuntu-latest
     container: