test: SEMI E5 known-answer tests for SECS-II encoding

Hex-string fixtures constructed directly from the SEMI E5 §9
format-byte encoding rules:

  format_byte = (format_code << 2) | length_byte_count
  length_byte_count ∈ {1, 2, 3}

Coverage:
- Every format code (L, B, BOOLEAN, A, J, C, U1-U8, I1-I8, F4, F8)
- Every length-byte-count variant (1, 2, 3 bytes — exercises the
  255 → 256 → 65 536 transitions)
- Numeric edges: 0, ±1, MIN, MAX, ±Inf, NaN, -0.0, multi-element vectors
- Empty and single-element variants
- Nested lists
- A "format byte layout per format code" regression tripwire that
  pins every code → byte mapping

19 test cases, 196 assertions.  Every fixture round-trips
byte-identical against the codec.

Why this is the strongest single codec test: every other validator
(secsgem-py interop, conformance harness, in-house unit tests) is
one implementer's interpretation.  KAT is the standard's own
arithmetic.  If our encoder matches these canonical bytes and our
decoder reverses them to the same Item, our SECS-II layer is wire-
compatible with anything else that obeys E5 §9.

NaN / signed-zero / Inf use a bit-pattern compare (IEEE NaN != NaN
breaks the default Item == path) — decode the canonical, re-encode
the decoded, assert byte-identical.

The 3-byte-length fixture (ASCII 65 536 × 'X') generates a ~200 KB
expected-bytes string in the test — slow to write but trivial to
check and forces the 3-byte length-prefix path that 99 % of real
traffic doesn't exercise.

Plan: VERIFICATION.md §1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CMakeLists.txt

@@ -164,6 +164,7 @@ add_executable(secsgem_tests
   tests/test_metrics_prometheus.cpp
   tests/test_hsms_gs_integration.cpp
   tests/test_robustness_fuzz.cpp
+  tests/test_e5_kat.cpp
 )
 target_link_libraries(secsgem_tests PRIVATE secsgem doctest::doctest)
 target_compile_definitions(secsgem_tests PRIVATE