feat(gem): multi-observer state-change handlers via HandlerSlot

The single-slot set_*_handler pattern was a structural blocker, hit twice:
the daemon could not observe control-state changes because
register_default_handlers owns the slot, forcing GetControlState to read the
FSM cross-thread (a data race), and blocking WatchHealth and the Subscribe
stream's ControlStateChange variant.

HandlerSlot<Args...> keeps a primary slot with exact legacy semantics
(set_ replaces — one existing test depends on replacement) plus an
append-only observer list (add_) that survives set_ calls. Fire sites are
textually unchanged (operator bool / operator() / assign-from-function).

Applied to ControlStateMachine + ProcessJobStore + ControlJobStore (the
roadmap-critical three; the remaining single-slot classes follow the same
3-line pattern as needed). EquipmentRuntime gains an atomic control-state
mirror registered as an observer — control_state() is now safe from any
thread, retiring the GetControlState race — plus add_control_state_observer
and add_link_observer (selected/closed fan-out), the hooks WatchHealth and
Subscribe need.

Tests: observer ordering, set-replaces-primary-but-observers-survive,
observers-without-primary, PJ-store coexistence, and the runtime scenario
that was previously impossible (mirror + observer + default-handlers set_).
Core 464/464 (2816 assertions), daemon 16/16, live GEM300 demo passes with
single-fire control-state transitions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

include/secsgem/gem/runtime.hpp

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <asio.hpp>
+#include <atomic>
 #include <cstdint>
 #include <functional>
 #include <memory>
@@ -8,6 +9,7 @@
 #include <string>
 #include <thread>
 #include <utility>
+#include <vector>
 
 #include "secsgem/config/loader.hpp"
 #include "secsgem/endpoint.hpp"
@@ -76,7 +78,22 @@ class EquipmentRuntime {
   }
 
   // ---- control state -------------------------------------------------------
-  ControlState control_state() const { return sm_->state(); }
+  // Safe from any thread: reads an atomic mirror updated by a state-machine
+  // observer, so gRPC threads never touch the FSM the io thread owns.
+  ControlState control_state() const { return control_state_cache_.load(std::memory_order_relaxed); }
+
+  // Observe control-state transitions (fires on the io thread). Survives the
+  // primary set_state_change_handler that register_default_handlers installs.
+  // Register before run()/run_async().
+  void add_control_state_observer(ControlStateMachine::StateChangeHandler h) {
+    sm_->add_state_change_handler(std::move(h));
+  }
+
+  // Observe HSMS link state: fires on the io thread with true when a session
+  // reaches SELECTED, false when the connection closes. Register before
+  // run()/run_async(). Foundation for the daemon's WatchHealth stream.
+  using LinkObserver = std::function<void(bool selected)>;
+  void add_link_observer(LinkObserver h) { link_observers_.push_back(std::move(h)); }
 
   // Deliver a primary to the host, or spool it if there's no SELECTED session.
   // Call on the io thread (e.g. from a router handler or a posted emitter).
@@ -100,6 +117,8 @@ class EquipmentRuntime {
   config::EquipmentDescriptor descriptor_;
   std::unique_ptr<Server> server_;
   Router router_;
+  std::atomic<ControlState> control_state_cache_{ControlState::HostOffline};
+  std::vector<LinkObserver> link_observers_;
   std::optional<asio::executor_work_guard<asio::io_context::executor_type>> work_;
   std::thread io_thread_;
 };