feat: EquipmentRuntime engine owner + secs_gemd gRPC daemon

Extract the SECS/GEM engine wiring out of the secs_server app into a
reusable class, and stand up a language-agnostic gRPC daemon on top so a
tool's software (any language) can drive the equipment without linking C++
or knowing SEMI. Foundation for replacing a vendor's SECS/GEM server.

Engine reuse:
- EquipmentRuntime (include/secsgem/gem/runtime.hpp, src/gem/runtime.cpp):
  owns io_context, passive Server, model, control-state machine, Router;
  thread-safe outbound API (set_variable/emit_event/set_alarm/clear_alarm),
  on_command hook, deliver_or_spool, run()/run_async()/poll()/stop().
- register_default_handlers (src/gem/default_handlers.cpp): the 56 GEM
  handlers + domain emitters, relocated from secs_server so the app and the
  daemon speak byte-identical GEM. secs_server.cpp reduced ~1270 -> 113 lines.
- name_index.hpp: resolve_variable(name) -> VID (the name->id binding layer).

Daemon (apps/secs_gemd.cpp, proto/secsgem/v1/equipment.proto):
- runs the engine + HSMS link on a background thread; serves the gRPC
  Equipment service. Increment 1: SetVariables (name-resolved, plain
  value->Item) and GetControlState. proto carries the full v1 surface
  (universal + carrier/recipe/job tiers); remaining RPCs + the Subscribe
  command stream are next (docs/DAEMON_ROADMAP.md).
- CMake: opt-in SECSGEM_DAEMON, protoc/grpc_cpp_plugin codegen, gracefully
  skipped where protobuf/grpc++ are absent. Dockerfile gains the grpc deps.

Tests (proof): test_runtime, test_default_handlers (S1F1->S1F2, S2F41->hook),
test_name_index. Full suite 458/458, 2795 assertions; live server<->client
GEM300 demo still passes on the refactored server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

include/secsgem/gem/name_index.hpp

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <string>
+
+#include "secsgem/gem/data_model.hpp"
+
+namespace secsgem::gem {
+
+// Resolve a human variable name to its numeric VID, spanning SVIDs and DVIDs
+// (one VID space). SVIDs win on a name collision. nullopt if unknown.
+//
+// This is the name->id half of the vendor-facing binding layer: the daemon and
+// any language client address items by the names from equipment.yaml, and the
+// engine stays numeric. Best-effort by design — duplicate names simply resolve
+// to the first match rather than erroring (see secsgem-vendor-accessibility).
+inline std::optional<uint32_t> resolve_variable(const EquipmentDataModel& m,
+                                                const std::string& name) {
+  for (const auto& sv : m.svids.all())
+    if (sv.name == name) return sv.id;
+  for (const auto& dv : m.dvids.all())
+    if (dv.name == name) return dv.id;
+  return std::nullopt;
+}
+
+}  // namespace secsgem::gem