feat: EquipmentRuntime engine owner + secs_gemd gRPC daemon

Extract the SECS/GEM engine wiring out of the secs_server app into a
reusable class, and stand up a language-agnostic gRPC daemon on top so a
tool's software (any language) can drive the equipment without linking C++
or knowing SEMI. Foundation for replacing a vendor's SECS/GEM server.

Engine reuse:
- EquipmentRuntime (include/secsgem/gem/runtime.hpp, src/gem/runtime.cpp):
  owns io_context, passive Server, model, control-state machine, Router;
  thread-safe outbound API (set_variable/emit_event/set_alarm/clear_alarm),
  on_command hook, deliver_or_spool, run()/run_async()/poll()/stop().
- register_default_handlers (src/gem/default_handlers.cpp): the 56 GEM
  handlers + domain emitters, relocated from secs_server so the app and the
  daemon speak byte-identical GEM. secs_server.cpp reduced ~1270 -> 113 lines.
- name_index.hpp: resolve_variable(name) -> VID (the name->id binding layer).

Daemon (apps/secs_gemd.cpp, proto/secsgem/v1/equipment.proto):
- runs the engine + HSMS link on a background thread; serves the gRPC
  Equipment service. Increment 1: SetVariables (name-resolved, plain
  value->Item) and GetControlState. proto carries the full v1 surface
  (universal + carrier/recipe/job tiers); remaining RPCs + the Subscribe
  command stream are next (docs/DAEMON_ROADMAP.md).
- CMake: opt-in SECSGEM_DAEMON, protoc/grpc_cpp_plugin codegen, gracefully
  skipped where protobuf/grpc++ are absent. Dockerfile gains the grpc deps.

Tests (proof): test_runtime, test_default_handlers (S1F1->S1F2, S2F41->hook),
test_name_index. Full suite 458/458, 2795 assertions; live server<->client
GEM300 demo still passes on the refactored server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

include/secsgem/gem/default_handlers.hpp

@@ -0,0 +1,18 @@
+#pragma once
+
+#include "secsgem/gem/runtime.hpp"
+
+namespace secsgem::gem {
+
+// Registers the full default GEM behaviour onto a runtime: every SECS message
+// handler (S1/S2/S3/S5/S6/S7/S10/S14/S16) on its Router, plus the state-change
+// emitters (control state, process/control jobs, exceptions, substrates,
+// modules) on its stores. Shared by the `secs_server` app and the gRPC daemon
+// so both speak byte-identical GEM — the protocol behaviour lives here, once.
+//
+// Call once after constructing the runtime and before run(). Application
+// behaviour (host-command callbacks via on_command, sensor value updates) is
+// layered on top by the caller.
+void register_default_handlers(EquipmentRuntime& R);
+
+}  // namespace secsgem::gem

include/secsgem/gem/name_index.hpp

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+
+#include "secsgem/gem/data_model.hpp"
+
+namespace secsgem::gem {
+
+// Resolve a human variable name to its numeric VID, spanning SVIDs and DVIDs
+// (one VID space). SVIDs win on a name collision. nullopt if unknown.
+//
+// This is the name->id half of the vendor-facing binding layer: the daemon and
+// any language client address items by the names from equipment.yaml, and the
+// engine stays numeric. Best-effort by design — duplicate names simply resolve
+// to the first match rather than erroring (see secsgem-vendor-accessibility).
+inline std::optional<uint32_t> resolve_variable(const EquipmentDataModel& m,
+                                                const std::string& name) {
+  for (const auto& sv : m.svids.all())
+    if (sv.name == name) return sv.id;
+  for (const auto& dv : m.dvids.all())
+    if (dv.name == name) return dv.id;
+  return std::nullopt;
+}
+
+}  // namespace secsgem::gem

include/secsgem/gem/runtime.hpp

@@ -0,0 +1,107 @@
+#pragma once
+
+#include <asio.hpp>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <optional>
+#include <string>
+#include <thread>
+#include <utility>
+
+#include "secsgem/config/loader.hpp"
+#include "secsgem/endpoint.hpp"
+#include "secsgem/gem/control_state.hpp"
+#include "secsgem/gem/data_model.hpp"
+#include "secsgem/gem/router.hpp"
+#include "secsgem/gem/store/host_commands.hpp"
+#include "secsgem/secs2/item.hpp"
+#include "secsgem/secs2/message.hpp"
+
+namespace secsgem::gem {
+
+// Owns the SECS/GEM engine — io_context, the passive HSMS Server, the data
+// model, the E30 control-state machine, and the Router — as one reusable
+// object. It is the foundation both the demo `secs_server` app and the gRPC
+// daemon build on, replacing a hand-wired main() with a class.
+//
+// Threading contract (unchanged from the engine's existing design): a single
+// io_context thread owns the model and the connection. The outbound methods
+// (set_variable / emit_event / set_alarm / clear_alarm) are safe to call from
+// any thread — each posts onto the io_context, exactly like the established
+// emit_* pattern. Router handlers and the command hook run on the io thread.
+class EquipmentRuntime {
+ public:
+  struct Config {
+    std::string equipment_yaml;
+    std::string control_state_yaml;
+    std::string process_job_yaml;
+    std::string control_job_yaml;
+    uint16_t port = 5000;
+    std::string spool_dir;                        // empty = no persistence
+    std::function<void(const std::string&)> log;  // empty = silent
+  };
+
+  explicit EquipmentRuntime(const Config& cfg);
+  ~EquipmentRuntime();
+
+  EquipmentRuntime(const EquipmentRuntime&) = delete;
+  EquipmentRuntime& operator=(const EquipmentRuntime&) = delete;
+
+  // ---- access --------------------------------------------------------------
+  EquipmentDataModel& model() { return *model_; }
+  const EquipmentDataModel& model() const { return *model_; }
+  Router& router() { return router_; }
+  ControlStateMachine& control() { return *sm_; }
+  asio::io_context& io() { return io_; }
+  uint16_t device_id() const { return descriptor_.device_id; }
+  void log(const std::string& m) const { if (log_) log_(m); }
+
+  // Shared-pointer / reference accessors used when wiring handlers and
+  // emitters that capture the engine pieces by value (see register handlers).
+  std::shared_ptr<EquipmentDataModel> model_ptr() { return model_; }
+  std::shared_ptr<ControlStateMachine> control_ptr() { return sm_; }
+  const config::EquipmentDescriptor& descriptor() const { return descriptor_; }
+  std::shared_ptr<std::weak_ptr<Connection>> active_conn() { return active_conn_; }
+
+  // ---- outbound: report state to the host (thread-safe; each posts) --------
+  void set_variable(uint32_t vid, secs2::Item value);
+  void emit_event(uint32_t ceid);
+  void set_alarm(uint32_t alid);
+  void clear_alarm(uint32_t alid);
+
+  // ---- host-command behaviour hook -----------------------------------------
+  void on_command(std::string rcmd, HostCommandRegistry::Handler h) {
+    model_->commands.set_handler(std::move(rcmd), std::move(h));
+  }
+
+  // ---- control state -------------------------------------------------------
+  ControlState control_state() const { return sm_->state(); }
+
+  // Deliver a primary to the host, or spool it if there's no SELECTED session.
+  // Call on the io thread (e.g. from a router handler or a posted emitter).
+  // Returns false if dropped (stream not spoolable and no host).
+  bool deliver_or_spool(secs2::Message msg, const std::string& what);
+
+  // ---- lifecycle -----------------------------------------------------------
+  void run();        // start accepting + run the io_context (blocks)
+  void run_async();  // run the io_context on a background thread
+  void poll();       // drain ready handlers without blocking (tests)
+  void stop();
+
+ private:
+  void wire_connection();
+
+  asio::io_context io_;
+  std::shared_ptr<EquipmentDataModel> model_;
+  std::function<void(const std::string&)> log_;
+  std::shared_ptr<std::weak_ptr<Connection>> active_conn_;
+  std::shared_ptr<ControlStateMachine> sm_;
+  config::EquipmentDescriptor descriptor_;
+  std::unique_ptr<Server> server_;
+  Router router_;
+  std::optional<asio::executor_work_guard<asio::io_context::executor_type>> work_;
+  std::thread io_thread_;
+};
+
+}  // namespace secsgem::gem