docs: customer-ready sweep + README restructure + tshark CI fix

Audit pass over the public-facing surface so a customer can read it
end-to-end without tripping on stale numbers or self-contradictions.

README + docs accuracy:
- Test counts 426 → 445, assertions 2 557 → 2 753 (verified via
  doctest run); E5 row was missing test_e5_kat (19 cases)
- Interop checks 24 → 31, COMPLIANCE.md message count 149 → 164,
  COMPLIANCE.md "291 cases / 1515 assertions" → 445 / 2 753
- README "60+ test IDs" for MES_INTEROP → actual 59
- PVD example counts: 32 SVIDs/17 CEIDs → 29/21, "~40 handlers
  in ~200 lines" → 51 in ~460, "~700 lines" → ~1,100; main.cpp
  header table-of-contents resynced with the actual 7 sections

Out-of-scope honesty (COMPLIANCE.md §8 + FAQ.md):
- Removed HSMS-GS (was both ✅ implemented in §1 and "out of scope"
  in §8; INTEGRATION.md §7 documents using it)
- Removed multi-block SECS-I (split_message/assemble_message exist
  with 4 dedicated tests)
- Added serial-port wiring as the genuine open ⬜ item — FSM is
  tested end-to-end over TCP; only the asio serial_port glue is
  deferred
- COMPLIANCE.md intro now lists E42 and notes "E37 (SS + GS)"

README restructure:
- Moved the 8-command proof table and per-standard test-coverage
  table to a new PROOFS.md (72 lines)
- README now leads with what / Quick start / Documentation map,
  then a one-paragraph "How it's proved" linking to PROOFS.md
- Updated cross-refs in FAQ.md, GLOSSARY.md, VERIFICATION.md, and
  interop/README.md to point at PROOFS.md

CI fix — tshark-dissector job:
- interop/tshark_validate.sh hardcoded /app/build/secs_server etc.
  which only works inside the docker image.  Now derives ROOT from
  the script's own location and accepts BUILD/SERVER/CLIENT/DATA
  env overrides, so CI can run it from the workspace dir
- Verified still passes in docker (69 frames, 0 malformed)

.gitignore:
- Added build-fuzz/ and build-tsan/ (were showing as untracked)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

interop/README.md

@@ -125,8 +125,8 @@ is consistent:
    non-Python validators).
 2. Wired into `.gitea/workflows/ci.yml` as a separate job.
 3. Listed in this README's table + in `../VERIFICATION.md`.
-4. Surfaced in the README's proof-of-feature-completeness table if
-   it adds a meaningful new dimension.
+4. Surfaced in [`../PROOFS.md`](../PROOFS.md) if it adds a
+   meaningful new dimension.
 
 Bug reports from a new validator → file at
 `raphael@maenle.net` with the wire trace, the validator's output,

interop/tshark_validate.sh

@@ -9,7 +9,10 @@
 # both our internal tests and the secsgem-py interop path.
 #
 # Usage: tshark_validate.sh [--port PORT]
-# Run inside the builder image (which has tshark + tcpdump).
+# Run inside the builder image (which has tshark + tcpdump), or on
+# any host with tshark + tcpdump installed.  Resolves $ROOT from the
+# script's own location, so /app/... and any out-of-source checkout
+# both work without env overrides.
 #
 # Exit codes:
 #   0 — tshark dissected every HSMS frame without errors
@@ -17,9 +20,12 @@
 #   2 — script error (binary missing, capture failed, etc.)
 set -euo pipefail
 
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 PORT=${PORT:-5099}
-SERVER=/app/build/secs_server
-CLIENT=/app/build/secs_client
+BUILD=${BUILD:-$ROOT/build}
+SERVER=${SERVER:-$BUILD/secs_server}
+CLIENT=${CLIENT:-$BUILD/secs_client}
+DATA=${DATA:-$ROOT/data}
 [ -x "$SERVER" ] || { echo "FAIL: $SERVER missing — rebuild first"; exit 2; }
 [ -x "$CLIENT" ] || { echo "FAIL: $CLIENT missing — rebuild first"; exit 2; }
 
@@ -44,10 +50,10 @@ sleep 0.5
 
 echo "starting secs_server on 127.0.0.1:$PORT"
 $SERVER --port "$PORT" --device 0 \
-    --config /app/data/equipment.yaml \
-    --state-table /app/data/control_state.yaml \
-    --pj-state-table /app/data/process_job_state.yaml \
-    --cj-state-table /app/data/control_job_state.yaml \
+    --config "$DATA/equipment.yaml" \
+    --state-table "$DATA/control_state.yaml" \
+    --pj-state-table "$DATA/process_job_state.yaml" \
+    --cj-state-table "$DATA/control_job_state.yaml" \
     > "$SERVER_LOG" 2>&1 &
 SERVER_PID=$!
 sleep 0.5