forgetest: cloud.service-protocol, the service answered by the emulator in this machine's identity

The service-protocol half of the cloud catalog on its own test: the cloud
client restarted as gfutilities' emulator under the /run/gfcloud-emulate
marker signs in, passes the firmware check, opens the WebSocket, answers
the connect-time hunt and the image requests with the dev image's canned
frames, and runs a print from the app through the real download path to
':completed' - nothing moves, nothing arms, and only the app has to be
driven, by a person or an agent through the prompt API. The real client
is restarted afterward and its hunt waited out. session_live now knows
the emulator's session is not the machine's, so enter_cloud restarts it
rather than reusing it; restart_client is the one restart the offline
and emulator entries share.

The dev image adds python3-gfutilities-emulator (the fixtures, packaged
on their own in meta-openglow); forgefirm-app moves to 12ad3b1 (gfcloud
--emulate). Catalog: 44 tests, 27 auto / 9 operator / 8 live; the new
test covers the gfutilities service layer and examples/, which step 4
will take off the other cloud tests. Replays over the prompt script;
contract and BRINGUP updated. A layer change (the dev image recipe):
everything re-requires on the next image.

docs/ACCEPTANCE.md

@@ -150,9 +150,16 @@ bench, or one whose `/data` has been wiped, starts from a full campaign.
    hunt run with the lid open, and the web-service homing (`$H` with
    `homing_mode = gfcloud`) after the switch back.
    The cloud tests split by what they prove. The service protocol (sign-in,
-   the WebSocket, the hunt, the print from the app, progress, the job's
-   limits reaching the engine) is `cloud.mode-switch` and one real print,
-   `cloud.pause-resume`. The machine's print behavior (the lid and
+   the firmware check, the WebSocket, the hunt, the image uploads, a
+   print's download and lifecycle as the app sees them) is
+   `cloud.service-protocol`: the cloud client restarted as gfutilities'
+   emulator in this machine's identity under the `/run/gfcloud-emulate`
+   marker, answering the real service with the dev image's canned frames
+   and running the print from the app without hardware, so only the app
+   has to be driven (by a person or an agent, anywhere). The service and
+   the machine together are `cloud.mode-switch` and one real print,
+   `cloud.pause-resume` (progress, the button wait, the job's limits
+   reaching the engine). The machine's print behavior (the lid and
    interlock aborts, the button-wait cancel, a paused print ended by the
    lid, a print longer than the ring with the app's cancel) runs under the
    **offline service** (`enter_offline`: the cloud client restarted with

docs/BRINGUP.md

@@ -48,7 +48,7 @@ hardware-validated.**
   modes (cancel-and-return on a lid or interlock open, button pause/resume),
   bench-validated 2026-08-17.
 - **Releases are gated by the acceptance tool** (`forgetest`, dev image only):
-  a 43-test catalog, domain-scoped inheritance, an always-required safety core,
+  a 44-test catalog, domain-scoped inheritance, an always-required safety core,
   and a release gate that reads the exported artifact. The latest full
   campaign, on dev image `20260822204234`, satisfied 43 of 43 from nothing and
   authorizes a release; **no release is cut yet.**
@@ -578,7 +578,7 @@ under the domain model from the day's earlier dev images) and the export reads "
 YES" for that image's manifest. That authorizes a release; it is not one
 until `releases/v<version>/acceptance.json` is committed.
 
-- **Catalog: 43 tests** in `forgetest/forgetest/suite/`, every one a port of a
+- **Catalog: 44 tests** in `forgetest/forgetest/suite/`, every one a port of a
   proven bench drill or a bench-verified check: the always-required core
   (`image.health`, `kernel.latch-locked-idle`, `kernel.k1-k2`,
   `kernel.fire-line`), `forgectrl.*`, `logs.*`, `update.*`, `motion.*`
@@ -587,13 +587,14 @@ until `releases/v<version>/acceptance.json` is committed.
   quiet after motion, a gate setting tripping and off by value, a fan under
   its floor), `camera.*`,
   `laser.*` (emission witness, arm-wait lid, disarm-in-hold, armed kill,
-  pause/resume/lid-cancel) and `cloud.*` (the mode round trip with the
-  lid-open hunt and the web-service homing on it, one real print, and the
-  job-behavior tests under the offline service: the cloud client driven
-  from a local socket with a synthesized laser-free job, no account, no
-  network, nothing on the bed). Tests that share a setup are merged; the
-  `auto` tests stay separate for failure isolation. 27 are `auto`, 8
-  `operator`, 8 `live`.
+  pause/resume/lid-cancel) and `cloud.*` (the service protocol answered by
+  the emulator in this machine's identity, with only the app to drive; the
+  mode round trip with the lid-open hunt and the web-service homing on it;
+  one real print; and the job-behavior tests under the offline service:
+  the cloud client driven from a local socket with a synthesized
+  laser-free job, no account, no network, nothing on the bed). Tests that
+  share a setup are merged; the `auto` tests stay separate for failure
+  isolation. 27 are `auto`, 9 `operator`, 8 `live`.
 - **The operator's part is asked for by name, not by popup**
   (`docs/ACCEPTANCE.md` "The operator's part"): a Ready prompt before a
   timed step, a standing notice the test takes down when the machine shows