ci: bake secs4j harness into image instead of bind-mounting

Second secs4j-interop CI failure:
  ensuring secs4j-interop image is built...
  compiling Secs4jHostHarness.java...
  error: file not found: Secs4jHostHarness.java
  FAIL: javac

The script bind-mounted $PWD/interop/secs4j into /work inside the
container so it could javac the harness at runtime.  That works
locally where docker daemon and script share a filesystem, but
fails in CI: the act runner runs the workflow inside a container,
the docker socket is mounted from the host, and the daemon
interprets bind-mount paths against the host filesystem — where
$PWD/interop/secs4j doesn't exist.  Result: empty /work, javac
errors, job fails.

Fix: COPY Secs4jHostHarness.java into the image and javac it at
image build time.  The script just runs the container — no bind
mount, no docker-in-docker mount path translation, works in CI and
locally.

Verified locally with a fresh image rebuild: 55/55 checks pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

interop/secs4j/Dockerfile

@@ -27,7 +27,16 @@ WORKDIR /opt/secs4java8
 # at image build so the harness can just include the resulting jar.
 RUN bash compile.sh
 
-# The harness source lives outside this image and is mounted at /work
+# Bake the harness into the image and compile it here.
-# when the container runs (so editing the harness doesn't require a
+#
-# rebuild).
+# The previous arrangement bind-mounted the harness from the host at
+# runtime, which fails when this script runs inside a CI container
+# whose docker socket points at a daemon on a different filesystem —
+# the host path interop/secs4j doesn't exist on the docker daemon's
+# side, so `docker run -v $PWD/interop/secs4j:/work` mounts an empty
+# directory and javac reports "file not found."  Copying the source
+# in at build time avoids the docker-in-docker volume problem
+# entirely.
 WORKDIR /work
+COPY Secs4jHostHarness.java /work/
+RUN javac -cp /opt/secs4java8/Export.jar Secs4jHostHarness.java

interop/secs4j_validate.sh

@@ -16,17 +16,15 @@ PORT=${PORT:-5099}
 
 cd "$(dirname "$0")/.."
 
-# Ensure the secs4j-interop image is built (idempotent).
+# Ensure the secs4j-interop image is built (idempotent).  The image
+# COPYs Secs4jHostHarness.java in and compiles it at build time, so
+# no bind mount is needed at run time — important because docker-
+# in-docker (CI runners with a mounted /var/run/docker.sock) can't
+# bind-mount paths from the container's filesystem to the daemon's.
 echo "ensuring secs4j-interop image is built..."
 docker build -t secsgem-secs4j-interop -f interop/secs4j/Dockerfile interop/secs4j \
     >/dev/null 2>&1
 
-# Ensure the harness is compiled.
-echo "compiling Secs4jHostHarness.java..."
-docker run --rm -v "$PWD/interop/secs4j:/work" secsgem-secs4j-interop \
-    bash -c "cd /work && javac -cp /opt/secs4java8/Export.jar Secs4jHostHarness.java" \
-    || { echo "FAIL: javac"; exit 2; }
-
 # Start the C++ server in background on the compose bridge network so
 # the secs4j container can DNS-resolve it.
 echo "starting secs_server (compose)..."
@@ -42,7 +40,6 @@ sleep 1
 echo "running Secs4jHostHarness..."
 docker run --rm \
     --network secs-gem_secs \
-    -v "$PWD/interop/secs4j:/work" \
     secsgem-secs4j-interop \
     java -cp /opt/secs4java8/Export.jar:/work Secs4jHostHarness server 5000