feat(gem): multi-observer state-change handlers via HandlerSlot

The single-slot set_*_handler pattern was a structural blocker, hit twice:
the daemon could not observe control-state changes because
register_default_handlers owns the slot, forcing GetControlState to read the
FSM cross-thread (a data race), and blocking WatchHealth and the Subscribe
stream's ControlStateChange variant.

HandlerSlot<Args...> keeps a primary slot with exact legacy semantics
(set_ replaces — one existing test depends on replacement) plus an
append-only observer list (add_) that survives set_ calls. Fire sites are
textually unchanged (operator bool / operator() / assign-from-function).

Applied to ControlStateMachine + ProcessJobStore + ControlJobStore (the
roadmap-critical three; the remaining single-slot classes follow the same
3-line pattern as needed). EquipmentRuntime gains an atomic control-state
mirror registered as an observer — control_state() is now safe from any
thread, retiring the GetControlState race — plus add_control_state_observer
and add_link_observer (selected/closed fan-out), the hooks WatchHealth and
Subscribe need.

Tests: observer ordering, set-replaces-primary-but-observers-survive,
observers-without-primary, PJ-store coexistence, and the runtime scenario
that was previously impossible (mirror + observer + default-handlers set_).
Core 464/464 (2816 assertions), daemon 16/16, live GEM300 demo passes with
single-fire control-state transitions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_runtime.cpp

@@ -64,3 +64,26 @@ TEST_CASE("EquipmentRuntime.on_command registers the behaviour hook on the model
   CHECK(ran);
   CHECK(res.ack == gem::HostCmdAck::Accept);
 }
+
+TEST_CASE("EquipmentRuntime control-state mirror tracks transitions; observers coexist with default handlers") {
+  gem::EquipmentRuntime rt(test_config());
+
+  int observed = 0;
+  rt.add_control_state_observer(
+      [&](gem::ControlState, gem::ControlState, gem::ControlEvent) { ++observed; });
+
+  // Simulate what register_default_handlers does: claim the PRIMARY slot
+  // after the runtime (mirror) and the observer are already registered.
+  rt.control().set_state_change_handler(
+      [](gem::ControlState, gem::ControlState, gem::ControlEvent) {});
+
+  CHECK(rt.control_state() == gem::ControlState::HostOffline);  // mirror initial
+
+  rt.control().on_host_request_online();  // HostOffline -> ... -> OnlineRemote
+
+  // The atomic mirror followed the FSM, and the added observer survived the
+  // primary set_ call — the exact scenario that used to be impossible.
+  CHECK(rt.control_state() == gem::ControlState::OnlineRemote);
+  CHECK(rt.control_state() == rt.control().state());
+  CHECK(observed == 2);  // two chained transitions
+}