gfhome: one-shot Glowforge web-service homing runner

New recipe installing /usr/sbin/gfhome.py and /etc/gfhome.conf.sample
(copied to /data/etc/gfhome.conf on first run). The runner signs the
machine in with its fused identity, opens the WSS control channel with
a held client reference (a clean disconnect is impossible through
ws_connect), and drives the GFUIService dispatch table itself - minus
print - so the service's camera homing sequence (settings -> hunt ->
lid image -> corner move -> lid image) runs against the real hardware
Machine. The service ends the sequence silently, so completion is a
hunt plus at least one motion followed by a configurable quiet window;
the lens is then re-referenced against the hall sensor for a
deterministic Z. Lid/e-stop are checked before the session, print
actions are refused, and exit codes distinguish configuration and
connection failures from an incomplete homing.

Installed in both images; invoked by the grblHAL controller for $H
when homing_mode = gfcloud in /data/forgefirm.conf.

meta-forgefirm/recipes-forgefirm/gfhome/files/gfhome.conf.sample

@@ -0,0 +1,28 @@
+# gfhome - Glowforge web-service homing configuration.
+# Copied to /data/etc/gfhome.conf on first run; edit the copy.
+# Machine identity (serial/password) is read from the OCOTP fuses.
+
+[SERVICE]
+server_url: https://app.glowforge.com
+status_service_url: wss://status.glowforge.com
+
+[FACTORY_FIRMWARE]
+# Homing sessions never fetch factory firmware.
+check: False
+
+[LOGGING]
+file: /data/log/gfhome/gfhome.log
+level: INFO
+save_sent_images: False
+
+[THERMAL]
+# The heater stays off during homing; thermal policy belongs to the
+# motion controller.
+water_heater_percent: 0
+max_start_temp: 30
+
+[MOTION]
+# Extra lens half-steps applied after the hunt (0 = hall reference).
+z_home_offset: 0
+warm_up_delay: 0
+cool_down_delay: 0