Table/YAML-driven refactor (Layer 1 start)

Move equipment capabilities and the E30 control state machine out of C++
code and into YAML data files; introduce a Router for SECS dispatch;
consolidate small files.

Behavioural changes: none.  Demo identical (15 SxFy transactions +
3 equipment-initiated primaries), 67 test cases / 384 assertions still
all green.  Structural changes only.

Why
---

The previous server.cpp held the equipment data dictionary (3 SVIDs,
2 ECIDs, 3 CEIDs, 2 alarms, 2 recipes, 4 host commands) as imperative
C++ in a 50-line `populate()` function, and routed inbound messages
through a 150-line if-ladder.  Adding a new SVID required a recompile.
Adding a new state transition required editing two switch statements
(`operator_*` and `on_host_request_*`).  The control state machine's
behavioural rules were spread across imperative code in two methods.

This is exactly what implementation_plan.md calls out as the wrong
shape: behavioural rules should live in versioned data, and every
runtime/test/analyzer should read from that data rather than re-encode
it.  This commit starts that move.

What's new
----------

data/equipment.yaml
  Equipment data dictionary.  Declarative SVIDs / ECIDs / CEIDs /
  alarms / recipes / host commands.  Host commands carry their HCACK
  ack code plus optional `emit_ceid` and `set_alarm` side-effects.
  Adding a new SVID or command is a YAML edit, no recompile.

data/control_state.yaml
  The E30 §6.2 control state transition table as data.  Each row is
  (from, on) -> (to [, then] [, ack]).  `then` chains an auto-advance
  through the transient AttemptOnline state.  The previous
  imperative switch is gone.

include/secsgem/config/loader.hpp + src/config/loader.cpp
  yaml-cpp-backed loader.  `load_control_state(path)` returns a
  ControlTransitionTable + initial state; `load_equipment(path, model)`
  populates the EquipmentDataModel and returns the device descriptor
  (id, MDLN, SOFTREV, optional auto-emit CEID).  Surfaces config
  errors with file path + field name via ConfigError.

include/secsgem/gem/router.hpp  (header-only)
  Small (stream, function) -> handler map.  Server registers all
  handlers once at startup, then the Connection's message handler is
  just `router.dispatch(msg)`.  Unhandled primaries with W set get
  SxF0 by default.  Replaces the if-ladder in secs_server.cpp.

include/secsgem/gem/control_state.hpp + .cpp
  ControlTransitionTable is the new pure data type.  ControlStateMachine
  is now a thin engine over the table: `fire(event)` looks up the row,
  optionally transitions, optionally chains a `then` transition, returns
  the ack code.  Behaviour rules no longer live in C++ switches.
  The default in-code table matches data/control_state.yaml row for row;
  tests rely on it so they don't need the YAML file.

include/secsgem/gem/data_model.hpp + .cpp
  `register_command(rcmd, CommandSpec)` replaces the function-handler
  signature.  CommandSpec = (HostCmdAck, optional emit_ceid, optional
  set_alarm).  `dispatch_command` returns a CommandResult so the server
  can fire the side-effects after S2F42 is sent.

apps/secs_server.cpp
  No populate(), no if-ladder.  Loads equipment.yaml + control_state.yaml
  at startup (clean error on bad config), wires the Router once,
  delegates dispatch.  Sm change handler reads emit_on_control_change
  from the YAML.  Welcome S10F3 removed for parity with config (a future
  YAML rule could re-introduce it declaratively).

tests/test_loader.cpp  (new)
  Verifies the YAML loader produces the same shape as the in-code
  default table, and that equipment.yaml populates every section
  (SVIDs/ECIDs/CEIDs/alarms/recipes/commands).  SECSGEM_DATA_DIR
  CMake define points at ${CMAKE_SOURCE_DIR}/data so tests don't
  depend on cwd.

CMakeLists.txt, Dockerfile
  find_package(yaml-cpp) and link.  libyaml-cpp-dev added to the
  Ubuntu base image (yaml-cpp 0.8 ships the modern target name).

File consolidation
------------------

Five small files removed; their content lives in fewer headers:

  - secs2/item.cpp        -> inline in secs2/item.hpp
  - secs2/message.cpp     -> inline in secs2/message.hpp
  - hsms/types.hpp        -> merged into hsms/header.hpp
  - hsms/frame.hpp        -> merged into hsms/header.hpp
  - hsms/frame.cpp        -> merged into hsms/header.cpp

hsms/header.hpp is now "the HSMS wire format" in one place: SType + status
enums + Timers + Header + Frame + constants.  All includers updated.

Net effect
----------

Before: equipment data dictionary lived in 50 lines of imperative
populate() inside secs_server.cpp; dispatch in a 20-branch if-ladder.

After: equipment data dictionary lives in 47 lines of YAML; dispatch
is a Router built once.  Adding a new capability is now a YAML edit
in the common case.

Test count up to 67 cases / 384 assertions (+4 cases / +106 assertions)
covering the loader and the new table-driven SM paths.

What's NOT changed
------------------

The per-SxFy reply construction still lives in C++ (each message has a
unique body shape).  Moving those into YAML/JSON message-shape
definitions is the next refactor step but requires a generic typed
encoder/decoder driven by shape descriptors; out of scope here.

Spooling, the S9 error stream, S1F19/F20, and the other gaps in
COMPLIANCE.md remain unchanged.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -25,36 +25,31 @@ docker compose up --no-deps server client   # live two-container demo
 
 ## Architecture
 
+The "spec-as-data" first step: equipment capabilities and the E30 control
+state machine are loaded from YAML at startup; the SECS dispatch is a
+`(stream, function) -> handler` Router rather than an if-ladder.
+
 ```
    ┌──────────────────────────────────────────────────────────────┐
+   │ data/equipment.yaml   data/control_state.yaml                │
+   │   SVIDs, ECIDs, CEIDs, alarms, recipes, host commands;       │
+   │   E30 control state transition table                         │
+   └──────────────────────┬───────────────────────────────────────┘
+                          │  (loaded at startup)
+                          ▼
+   ┌──────────────────────────────────────────────────────────────┐
    │                        app / demo                            │
    │   apps/secs_server.cpp        apps/secs_client.cpp           │
+   │   uses gem::Router for SECS dispatch                         │
    └────────────┬───────────────────────────┬─────────────────────┘
                 │                           │
                 ▼                           ▼
    ┌──────────────────────────────────────────────────────────────┐
-   │                 secsgem::gem  (E30 / E5 logic)               │
-   │  data_model.hpp   SVIDs, DVIDs, ECIDs, CEIDs, alarms,        │
-   │                   reports, links, recipes                    │
-   │  control_state.h  E30 control state machine                  │
-   │  messages.hpp     all SxFy builders + parsers                │
-   └────────────┬─────────────────────────────────────────────────┘
-                │
-                ▼
-   ┌──────────────────────────────────────────────────────────────┐
-   │                 secsgem::hsms  (E37 transport)               │
-   │  Connection      async TCP, state machine, T3/T5/T6/T7/T8    │
-   │  Frame, Header   4-byte length prefix + 10-byte header       │
-   │  Server, Client  endpoint wrappers (in include/secsgem/)     │
-   └────────────┬─────────────────────────────────────────────────┘
-                │
-                ▼
-   ┌──────────────────────────────────────────────────────────────┐
-   │                 secsgem::secs2  (E5 codec)                   │
-   │  Item            variant over L/A/B/BOOLEAN/I1-8/U1-8/F4/F8  │
-   │  encode/decode   big-endian, length-byte aware               │
-   │  Message         SxFy + W-bit + optional root Item           │
-   │  to_sml          human-readable text for logs                │
+   │ secsgem::config   loader.hpp  YAML -> tables + data model    │
+   │ secsgem::gem      control_state (table-driven), data_model,  │
+   │                   messages (SxFy builders), router           │
+   │ secsgem::hsms     Connection (Asio), Header, Frame, Timers   │
+   │ secsgem::secs2    Item, codec (encode/decode), Message       │
    └──────────────────────────────────────────────────────────────┘
 ```
 
@@ -66,16 +61,42 @@ secs-gem/
 ├── CMakeLists.txt
 ├── implementation_plan.md              # the 7-layer spec-as-data roadmap
 ├── COMPLIANCE.md                       # per-capability E5/E30/E37 audit
+├── data/
+│   ├── equipment.yaml                  # SVIDs/ECIDs/CEIDs/alarms/recipes/commands
+│   └── control_state.yaml              # E30 transition table
 ├── include/secsgem/
 │   ├── secs2/{item,codec,message}.hpp
-│   ├── hsms/{types,header,frame,connection}.hpp
-│   ├── gem/{control_state,data_model,messages}.hpp
+│   ├── hsms/{header,connection}.hpp    # header.hpp also holds Frame + Timers
+│   ├── gem/{control_state,data_model,messages,router}.hpp
+│   ├── config/loader.hpp
 │   └── endpoint.hpp
-├── src/{secs2,hsms,gem,endpoint.cpp}/*.cpp
+├── src/{secs2,hsms,gem,config}/*.cpp + endpoint.cpp
 ├── apps/{secs_server,secs_client}.cpp
 └── tests/test_*.cpp
 ```
 
+### Adding a capability without recompiling the server
+
+```yaml
+# data/equipment.yaml — append a new SVID
+svids:
+  - {id: 4, name: ChamberTemp, units: "C", type: U4, value: 25}
+```
+
+```yaml
+# data/equipment.yaml — append a new host command + side effect
+host_commands:
+  - {name: VENT, ack: Accept, emit_ceid: 400, set_alarm: 2}
+```
+
+```yaml
+# data/control_state.yaml — append a new transition
+transitions:
+  - {from: OnlineRemote, on: host_request_offline, to: EquipmentOffline, ack: Accept}
+```
+
+Restart the server; the new behaviour is live. The C++ code unchanged.
+
 ## What's implemented
 
 ### HSMS (E37)