feat(daemon): D10 carriers + E16 ops RPCs + stress test + virtual fab

Completes the daemon's GEM300 surface and adds two new test tiers.

D10 — E87 carriers: CarrierStore gains the HandlerSlot observer pattern
(add_id/slot_map/access_handler). The daemon's id-observer forwards host
S3F17 decisions onto the Subscribe stream as CarrierAction (PROCEED on a
Confirmed transition, CANCEL on CancelCarrier); ReportCarrier drives the
flow tool-side: WAITING creates the carrier + records the slot map,
IN_ACCESS/COMPLETE advance the access FSM (INVALID_OBJECT on unknown,
CANNOT_DO_NOW on an illegal transition).

E16 — operations RPCs: Describe (full name inventory: variables/events/
alarms/commands/constants + device header), FlushSpool (purge or drain),
SendTerminalMessage (S10F1 tool->host, honest CANNOT_DO_NOW when no host
and stream 10 isn't spoolable).

Stream responsiveness: Subscribe/WatchHealth poll at 100ms (was 500ms) so a
cancelled stream frees its sync-server worker thread promptly — this was
found by the new stress test, which hung under Subscribe churn at 500ms.

Tests:
- A randomized concurrent RPC stress case: 4 threads x 250 seeded ops
  (set/get/fire/alarm/control-state/describe + Subscribe churn), asserts no
  failed RPC and a still-responsive engine afterward; prints its seed; a
  strong TSan target.
- A virtual fab (interop/virtual_fab.py + the `fab` compose service /
  tools/spawn_fab.sh): N daemons, each with a secsgem-py host AND a
  secsgem_client tool, driven by seeded random traffic with end-to-end
  invariant checks (set/get round-trips, event->S6F11 and alarm->S5F1
  delivery, command->tool->completion). Verified green at N=3 (~150 ops/eq,
  all commands round-tripped, 0 violations). Wired into run_interop.sh
  (now 13 steps).

Also fixes the CI break from the previous commit: the Python-client lane's
test_values.py step lacked PYTHONPATH=clients/python (now step-level env).

Two bugs found and fixed while building this, both mine from this batch:
1. carrier test hung on a CancelCarrier of a still-NotConfirmed carrier — a
   self-transition the FSM doesn't signal, so the observer never fired and
   the stream Read blocked forever. Fixed to cancel a Confirmed carrier;
   the NotConfirmed edge is documented as a known E87 limitation.
2. the 500ms stream poll above.

Daemon suite 7 cases / 214 assertions; core 475 / 3097; virtual fab green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

include/secsgem/gem/store/carriers.hpp

@@ -14,6 +14,7 @@
 #include <utility>
 #include <vector>
 
+#include "secsgem/gem/handler_slot.hpp"
 #include "secsgem/gem/carrier_state.hpp"
 #include "secsgem/gem/load_port_state.hpp"
 
@@ -62,9 +63,15 @@ class CarrierStore {
   CarrierStore(CarrierStore&&) = delete;
   CarrierStore& operator=(CarrierStore&&) = delete;
 
+  // set_ replaces the primary handler (legacy semantics); add_ appends an
+  // observer that survives set_ calls (see handler_slot.hpp). The gRPC
+  // daemon observes via add_ to forward E87 actions onto its tool stream.
   void set_id_handler(IDChangeHandler h)             { on_id_ = std::move(h); }
   void set_slot_map_handler(SlotMapChangeHandler h)  { on_sm_ = std::move(h); }
   void set_access_handler(AccessChangeHandler h)     { on_acc_ = std::move(h); }
+  void add_id_handler(IDChangeHandler h)             { on_id_.add(std::move(h)); }
+  void add_slot_map_handler(SlotMapChangeHandler h)  { on_sm_.add(std::move(h)); }
+  void add_access_handler(AccessChangeHandler h)     { on_acc_.add(std::move(h)); }
 
   enum class CreateResult { Created, Denied_AlreadyExists };
 
@@ -301,9 +308,12 @@ class CarrierStore {
   }
 
   std::map<std::string, Carrier> carriers_;
-  IDChangeHandler      on_id_;
-  SlotMapChangeHandler on_sm_;
-  AccessChangeHandler  on_acc_;
+  HandlerSlot<const std::string&, CarrierIDStatus, CarrierIDStatus,
+              CarrierIDEvent> on_id_;
+  HandlerSlot<const std::string&, SlotMapStatus, SlotMapStatus,
+              SlotMapEvent> on_sm_;
+  HandlerSlot<const std::string&, CarrierAccessStatus, CarrierAccessStatus,
+              CarrierAccessEvent> on_acc_;
   bool persistent_ = false;
   std::filesystem::path journal_dir_;
   uint64_t next_seq_ = 0;