ci: bake secs4j harness into image instead of bind-mounting

Second secs4j-interop CI failure:
  ensuring secs4j-interop image is built...
  compiling Secs4jHostHarness.java...
  error: file not found: Secs4jHostHarness.java
  FAIL: javac

The script bind-mounted $PWD/interop/secs4j into /work inside the
container so it could javac the harness at runtime.  That works
locally where docker daemon and script share a filesystem, but
fails in CI: the act runner runs the workflow inside a container,
the docker socket is mounted from the host, and the daemon
interprets bind-mount paths against the host filesystem — where
$PWD/interop/secs4j doesn't exist.  Result: empty /work, javac
errors, job fails.

Fix: COPY Secs4jHostHarness.java into the image and javac it at
image build time.  The script just runs the container — no bind
mount, no docker-in-docker mount path translation, works in CI and
locally.

Verified locally with a fresh image rebuild: 55/55 checks pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

interop/secs4j/Dockerfile

@@ -27,7 +27,16 @@ WORKDIR /opt/secs4java8
 # at image build so the harness can just include the resulting jar.
 RUN bash compile.sh
 
-# The harness source lives outside this image and is mounted at /work
-# when the container runs (so editing the harness doesn't require a
-# rebuild).
+# Bake the harness into the image and compile it here.
+#
+# The previous arrangement bind-mounted the harness from the host at
+# runtime, which fails when this script runs inside a CI container
+# whose docker socket points at a daemon on a different filesystem —
+# the host path interop/secs4j doesn't exist on the docker daemon's
+# side, so `docker run -v $PWD/interop/secs4j:/work` mounts an empty
+# directory and javac reports "file not found."  Copying the source
+# in at build time avoids the docker-in-docker volume problem
+# entirely.
 WORKDIR /work
+COPY Secs4jHostHarness.java /work/
+RUN javac -cp /opt/secs4java8/Export.jar Secs4jHostHarness.java