ci: bake secs4j harness into image instead of bind-mounting

Second secs4j-interop CI failure:
  ensuring secs4j-interop image is built...
  compiling Secs4jHostHarness.java...
  error: file not found: Secs4jHostHarness.java
  FAIL: javac

The script bind-mounted $PWD/interop/secs4j into /work inside the
container so it could javac the harness at runtime.  That works
locally where docker daemon and script share a filesystem, but
fails in CI: the act runner runs the workflow inside a container,
the docker socket is mounted from the host, and the daemon
interprets bind-mount paths against the host filesystem — where
$PWD/interop/secs4j doesn't exist.  Result: empty /work, javac
errors, job fails.

Fix: COPY Secs4jHostHarness.java into the image and javac it at
image build time.  The script just runs the container — no bind
mount, no docker-in-docker mount path translation, works in CI and
locally.

Verified locally with a fresh image rebuild: 55/55 checks pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

interop/secs4j_validate.sh

@@ -16,17 +16,15 @@ PORT=${PORT:-5099}
 
 cd "$(dirname "$0")/.."
 
-# Ensure the secs4j-interop image is built (idempotent).
+# Ensure the secs4j-interop image is built (idempotent).  The image
+# COPYs Secs4jHostHarness.java in and compiles it at build time, so
+# no bind mount is needed at run time — important because docker-
+# in-docker (CI runners with a mounted /var/run/docker.sock) can't
+# bind-mount paths from the container's filesystem to the daemon's.
 echo "ensuring secs4j-interop image is built..."
 docker build -t secsgem-secs4j-interop -f interop/secs4j/Dockerfile interop/secs4j \
     >/dev/null 2>&1
 
-# Ensure the harness is compiled.
-echo "compiling Secs4jHostHarness.java..."
-docker run --rm -v "$PWD/interop/secs4j:/work" secsgem-secs4j-interop \
-    bash -c "cd /work && javac -cp /opt/secs4java8/Export.jar Secs4jHostHarness.java" \
-    || { echo "FAIL: javac"; exit 2; }
-
 # Start the C++ server in background on the compose bridge network so
 # the secs4j container can DNS-resolve it.
 echo "starting secs_server (compose)..."
@@ -42,7 +40,6 @@ sleep 1
 echo "running Secs4jHostHarness..."
 docker run --rm \
     --network secs-gem_secs \
-    -v "$PWD/interop/secs4j:/work" \
     secsgem-secs4j-interop \
     java -cp /opt/secs4java8/Export.jar:/work Secs4jHostHarness server 5000