100%/B: S9F3/F5/F11 emission + Router fallback

Closes the S9 stream.  Every documented protocol-error condition is now
auto-emitted by Connection (with the assist of one Router predicate),
without involving the application.

Router (include/secsgem/gem/router.hpp)
  Adds two predicates: has_handler(stream, function) and
  has_handler_for_stream(stream).  Lets the wrapping message handler
  decide whether an unhandled message is "unknown stream" (S9F3) or
  "unknown function in a known stream" (S9F5).

Connection (include/secsgem/hsms/{connection.hpp, connection.cpp})
  - emit_s9() goes public so the message_handler can call it.
  - New current_header() accessor returns the HSMS header of the
    primary currently being dispatched.  Non-null only inside the
    on_message_ call; cleared on the way out.
  - handle_data sets current_header_ before invoking on_message_.
  - on_length on oversized frame: synthesizes a 10-byte MHEAD whose
    first 4 bytes are the offending length prefix, emits S9F11, and
    sets close_after_flush so the S9F11 goes out before the socket
    closes.

Server (apps/secs_server.cpp)
  The conn->set_message_handler lambda now wraps router.dispatch.  For
  any inbound primary without a registered handler, it captures the
  MHEAD via current_header() and emits either S9F3 (stream unknown) or
  S9F5 (function unknown).  The wrapper still returns the Router's
  reply (SxF0 for primaries with W) so transactional semantics are
  preserved.

COMPLIANCE.md
  Error Messages row flips from 🟡 to ✅.  S9F3/F5/F11 rows in the
  coverage matrix flip from 🟡 to ✅.  Each row in the matrix now
  states its trigger condition explicitly.  Drops the
  "Finish S9 wiring" bullet from the "what would 100% take" list.

Verified
  - Tests: 78 cases / 454 assertions still pass (no behavioural change
    on the happy path; new emission paths fire only on protocol errors
    that the demo doesn't induce).
  - Build clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/secs_server.cpp

@@ -399,8 +399,26 @@ int main(int argc, char** argv) {
       logfn(std::string("host is online; control=") + gem::control_state_name(sm->state()));
     });
 
-    conn->set_message_handler(
-        [&router](const s2::Message& msg) { return router.dispatch(msg); });
+    // Wrap router.dispatch so we can emit S9F3 / S9F5 when an inbound
+    // primary has no registered handler.  We use Connection's
+    // current_header() accessor to capture the offending MHEAD; without
+    // it we'd be left fabricating a synthetic header.
+    std::weak_ptr<Connection> wconn = conn;
+    conn->set_message_handler([&router, wconn, logfn](const s2::Message& msg)
+                                  -> std::optional<s2::Message> {
+      if (!router.has_handler(msg.stream, msg.function)) {
+        auto c = wconn.lock();
+        if (c && c->current_header()) {
+          const uint8_t s9_function =
+              router.has_handler_for_stream(msg.stream) ? 5 : 3;
+          logfn("unhandled S" + std::to_string(msg.stream) + "F" +
+                std::to_string(msg.function) + "; emitting S9F" +
+                std::to_string(s9_function));
+          c->emit_s9(s9_function, c->current_header()->encode());
+        }
+      }
+      return router.dispatch(msg);
+    });
   });
 
   server.start();