conformance: expand harness from 8 to 47 host-driven checks

The previous harness only exercised S1F1/F11/F13/F19, S2F17/F29, S5F5,
S7F19 — about 15% of what COMPLIANCE.md claims as ✅.  Customers running
secs_conformance against their tool got near-zero conformance signal
on dynamic event reports, GEM 300, alarm management, exception
recovery, terminal services, spool, and PP management.

This expansion covers, in one sequential run:
- Establish comms + identification (S1F13/F1)
- Status / DVID / CEID / EC namelists + values
  (S1F11/F3/F21/F23, S2F29/F13)
- Dynamic event reports: define / link / enable + readback paths
  (S2F33/F35/F37, S6F15/F19/F21)
- All three remote-command forms (S2F41/F21/F49)
- Equipment-initiated S6F11 observation triggered by RCMD=START
- Trace init, limits attrs, spool reset + transmit
  (S2F23, S2F47, S2F43, S6F23)
- Alarm management: list, list-enabled, enable (S5F5/F7/F3)
- Exception recovery: request + abort (S5F13/F17)
- PP load-inquire / list / request (S7F1/F19/F5)
- Terminal display both directions (S10F3, S10F5)
- E40 PJ create / monitor / command / dequeue
  (S16F11/F7/F5/F13)
- E94 CJ create / command / delete (S14F9, S16F27, S14F11)
- E87 carrier action / slot map / transfer / cancel
  (S3F17/F19/F25/F27)
- E39 GetAttr (S14F1)
- GEM compliance self-report (S1F19)

Pass criterion is the spec-mandated reply function code, not any
specific ACK value — CarrierIDUnknown / Denied_UnknownObject /
PpidNotFound / Error are well-formed F-coded replies and count as
protocol-conformant.  This lets the harness run against any equipment
without preloading state.

47 / 47 PASS against the in-repo demo server.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

COMPLIANCE.md

@@ -351,6 +351,20 @@ edge cases — not just the happy path.
 The E30 §6.5 Communication state machine is unit-tested independently of
 the transport (timer firings simulated via test callbacks).
 
+Live conformance harness: **`build/secs_conformance --host <ip> --port <p>`**
+walks 47 host-driven checks against a passive equipment, covering every
+E30 fundamental + additional capability that COMPLIANCE.md ✅ — establish
+comms, identification, status/DVID/CEID/EC namelists + values, dynamic
+event reports (define/link/enable + S6F15/F19/F21 readbacks), unsolicited
+S6F11 observation after RCMD, all three remote-command forms
+(S2F41/F21/F49), trace init, limits, spool reset + transmit, alarms
+(list/list-enabled/enable), exception recover/abort (S5F13/F17), PP
+load-inquire/list/request, both terminal-display directions
+(S10F3/F5), E40 PJ create/monitor/command/dequeue, E94 CJ
+create/command/delete, E87 carrier action/slot-map/transfer/cancel,
+and E39 GetAttr.  Exits 0 with PASS/FAIL summary; intended to be run
+against vendor equipment as the first-line conformance probe.
+
 ---
 
 ## 7. Interoperability with secsgem-py 0.3.0