chore(phase0): name validation, golden frames, daemon into library tree, TSan daemon lane

Item 8a — ConfigValidator warns on non-identifier variable/event/alarm/
command names ([A-Za-z_][A-Za-z0-9_]*): language bindings expose names as
kwargs/attributes, so 'Chamber Pressure' would be unusable in the planned
Python client. Warning not error — the wire doesn't care. Tested (4 warning
sites + good-name negative).

Item 4 tail — golden frames for S5F1 (Binary ALCD / U4 ALID / ASCII ALTX)
and a composed S6F11 (the production-critical report shape), bytes hand-
computed from E5 encoding rules: external pins on message composition.

Item 7 — equipment_service.hpp moved to include/secsgem/daemon/ (apps/
include-path hack removed) and a TSan daemon lane added locally + in CI.
tools/tsan.supp suppresses races whose accesses sit entirely inside the
UNinstrumented system libgrpc/libgpr/libabsl (epoll wakeups, absl Mutex
GraphCycles bookkeeping); our frames stay fully checked. The lane earned its
keep on first run: it caught a REAL threading-contract violation — a daemon
test reading model stores from the test thread while the io thread serviced
posted writes — fixed to use read_sync, exactly per the documented contract.
Now TSan-clean under halt_on_error=1 in the full production threading shape.

Suites: core 470/3068, daemon Release+TSan 125/125 each.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_config_validate.cpp

@@ -202,3 +202,32 @@ TEST_CASE("Validate: ships data/equipment.yaml without errors") {
   }
   CHECK(v.error_count() == 0);
 }
+
+TEST_CASE("Validate: non-identifier names warn (bindings expose names as kwargs)") {
+  auto p = scratch_path("idname", "yaml");
+  write(p, R"YAML(
+device:
+  id: 0
+  model_name: "TEST"
+  software_rev: "1.0"
+svids:
+  - {id: 1, name: "Chamber Pressure", type: F4, value: 0.0}
+  - {id: 2, name: GoodName,           type: U4, value: 0}
+ceids:
+  - {id: 10, name: "wafer-complete"}
+alarms:
+  - {id: 1, name: "2bad", text: "T", category: 1}
+host_commands:
+  - {name: "DO IT", ack: Accept}
+)YAML");
+  ConfigValidator v;
+  v.validate_equipment(p.string());
+  CHECK(v.error_count() == 0);   // identifier shape is a WARNING, not an error
+  CHECK(v.warning_count() == 4); // space, hyphen, leading digit, space
+  CHECK(any_match(v.issues(), "svids[0].name"));
+  CHECK(any_match(v.issues(), "ceids[0].name"));
+  CHECK(any_match(v.issues(), "alarms[0].name"));
+  CHECK(any_match(v.issues(), "host_commands[0].name"));
+  CHECK_FALSE(any_match(v.issues(), "svids[1].name"));
+  fs::remove_all(p.parent_path());
+}