chore(phase0): name validation, golden frames, daemon into library tree, TSan daemon lane

Item 8a — ConfigValidator warns on non-identifier variable/event/alarm/
command names ([A-Za-z_][A-Za-z0-9_]*): language bindings expose names as
kwargs/attributes, so 'Chamber Pressure' would be unusable in the planned
Python client. Warning not error — the wire doesn't care. Tested (4 warning
sites + good-name negative).

Item 4 tail — golden frames for S5F1 (Binary ALCD / U4 ALID / ASCII ALTX)
and a composed S6F11 (the production-critical report shape), bytes hand-
computed from E5 encoding rules: external pins on message composition.

Item 7 — equipment_service.hpp moved to include/secsgem/daemon/ (apps/
include-path hack removed) and a TSan daemon lane added locally + in CI.
tools/tsan.supp suppresses races whose accesses sit entirely inside the
UNinstrumented system libgrpc/libgpr/libabsl (epoll wakeups, absl Mutex
GraphCycles bookkeeping); our frames stay fully checked. The lane earned its
keep on first run: it caught a REAL threading-contract violation — a daemon
test reading model stores from the test thread while the io thread serviced
posted writes — fixed to use read_sync, exactly per the documented contract.
Now TSan-clean under halt_on_error=1 in the full production threading shape.

Suites: core 470/3068, daemon Release+TSan 125/125 each.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -79,6 +79,7 @@ jobs:
           apt-get install -y --no-install-recommends \
             build-essential cmake ninja-build \
             libasio-dev libyaml-cpp-dev \
+            libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
             python3 python3-yaml
 
       # Debug + -fsanitize=thread.  Catches data races in the
@@ -98,6 +99,18 @@ jobs:
           TSAN_OPTIONS: halt_on_error=1
         run: build-tsan/secsgem_tests
 
+      # The daemon under TSan: run_async + concurrent gRPC handler threads is
+      # the production threading shape — this is where a strand-contract
+      # violation would actually surface. tools/tsan.supp silences false
+      # positives inside the UNinstrumented system libgrpc only; our frames
+      # stay fully checked.
+      - name: Daemon tests (TSan)
+        env:
+          TSAN_OPTIONS: halt_on_error=1 suppressions=tools/tsan.supp
+        run: |
+          test -x build-tsan/secs_gemd_tests || { echo "secs_gemd_tests not built under TSan"; exit 1; }
+          build-tsan/secs_gemd_tests
+
   tshark-dissector:
     runs-on: ubuntu-latest
     container: