feat(clients)+test(interop): C++ client + Java validation of the daemon (B7)

B7 — the daemon's HSMS face under the Java reference: Dockerfile.server now
bakes secs_gemd alongside secs_server (grpc deps in both stages), and
secs4j_validate.sh gains TARGET=gemd to point the 55-check secs4java8 suite
at the daemon instead. Result: 55/55 green. With secsgem-py already
validating both faces, byte-identical GEM between secs_server and secs_gemd
is now proven by both reference implementations, not inferred from shared
code. CI runs the daemon target as an extra step (image layers shared).

Second client — clients/cpp: a header-only C++ twin of the Python client
over the same proto. eq.set("ChamberPressure", 2.5) with bare literals
(integral/floating dispatch avoids variant ambiguity), get/fire/alarm/
clear, control_state/request_control_state/health, on("START", fn) +
listen()/listen_async()/stop() with auto-CompleteCommand, SecsGemError
carrying the daemon's message. cpp_mini_tool (~30 lines) mirrors the
Python mini_tool. Tested end-to-end over real loopback TCP against the
service inside secs_gemd_tests — now 4 cases / 141 assertions — including
set/get round-trips, error text, alarm-by-name into the model, health,
and the full HCACK-4 command loop with parameters.

(Build note: two grpc-heavy TUs at -O3 OOM even at -j2 on Docker Desktop;
built -j1. Known environment limitation, roadmap-documented.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

interop/Dockerfile.server

@@ -17,6 +17,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential cmake ninja-build \
         libasio-dev libyaml-cpp-dev \
+        libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
         python3 python3-yaml \
         git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
@@ -24,20 +25,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 WORKDIR /src
 COPY . /src
 RUN cmake -S /src -B /src/build -G Ninja -DCMAKE_BUILD_TYPE=Release \
- && cmake --build /src/build --target secs_server
+ && cmake --build /src/build --target secs_server secs_gemd
 
 
 FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
+# Dev packages in the runtime layer purely to pull the grpc/protobuf
+# runtime libs by reliable names; image size is irrelevant for a CI harness.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        libyaml-cpp0.8 \
+        libyaml-cpp0.8 libgrpc++-dev libprotobuf-dev \
     && rm -rf /var/lib/apt/lists/*
 
 # WORKDIR must be the directory holding `data/` because secs_server's
 # default --config / --state-table paths are relative ("data/...").
 WORKDIR /app
 COPY --from=build /src/build/secs_server /usr/local/bin/secs_server
+COPY --from=build /src/build/secs_gemd   /usr/local/bin/secs_gemd
 COPY data /app/data
 
 EXPOSE 5000

interop/secs4j_validate.sh

@@ -10,6 +10,10 @@
 # filesystem.  Wired into CI via .gitea/workflows/ci.yml.
 #
 # Usage: bash interop/secs4j_validate.sh
+#        TARGET=gemd bash interop/secs4j_validate.sh
+#            -> runs the same 55 checks against secs_gemd's HSMS face
+#               (the daemon must be byte-identical GEM to secs_server,
+#               since both sit on register_default_handlers).
 # Exit codes:
 #   0 — every check the harness defines passed
 #   1 — one or more checks failed
@@ -41,13 +45,22 @@ docker build -t secsgem-secs4j-interop -f interop/secs4j/Dockerfile interop/secs
 docker network rm "$NET" >/dev/null 2>&1 || true
 docker network create "$NET" >/dev/null
 
-echo "starting secs_server..."
+echo "starting ${TARGET:-server} (secs4j peer)..."
 # --name doubles as the DNS hostname on the user-defined network, so
 # the harness reaches it as "secs4j-interop-server:5000".
-docker run -d --rm \
-    --name "$SERVER_NAME" \
-    --network "$NET" \
-    secsgem-secs4j-server >/dev/null
+if [ "${TARGET:-server}" = "gemd" ]; then
+    docker run -d --rm \
+        --name "$SERVER_NAME" \
+        --network "$NET" \
+        --entrypoint /usr/local/bin/secs_gemd \
+        secsgem-secs4j-server \
+        --port 5000 --grpc 0.0.0.0:50051 --config-dir /app/data >/dev/null
+else
+    docker run -d --rm \
+        --name "$SERVER_NAME" \
+        --network "$NET" \
+        secsgem-secs4j-server >/dev/null
+fi
 
 # Give the server a moment to bind.
 sleep 1