gfhome: one-shot Glowforge web-service homing runner

New recipe installing /usr/sbin/gfhome.py and /etc/gfhome.conf.sample
(copied to /data/etc/gfhome.conf on first run). The runner signs the
machine in with its fused identity, opens the WSS control channel with
a held client reference (a clean disconnect is impossible through
ws_connect), and drives the GFUIService dispatch table itself - minus
print - so the service's camera homing sequence (settings -> hunt ->
lid image -> corner move -> lid image) runs against the real hardware
Machine. The service ends the sequence silently, so completion is a
hunt plus at least one motion followed by a configurable quiet window;
the lens is then re-referenced against the hall sensor for a
deterministic Z. Lid/e-stop are checked before the session, print
actions are refused, and exit codes distinguish configuration and
connection failures from an incomplete homing.

Installed in both images; invoked by the grblHAL controller for $H
when homing_mode = gfcloud in /data/forgefirm.conf.

meta-forgefirm/recipes-forgefirm/images/forgefirm-image.bb

@@ -12,6 +12,8 @@ IMAGE_INSTALL:remove = "gfui-client"
 
 # grblhal-glowforge: the grblHAL motion controller (Grbl over TCP:23).
 # forgectrl: the ForgeFIRM control daemon (camera MJPEG service on :8080).
+# gfhome: one-shot Glowforge web-service homing, invoked by the controller
+# for $H when homing_mode = gfcloud (/data/forgefirm.conf).
 # v4l-utils provides media-ctl / v4l2-ctl for the imx-media pipeline (also a
 # forgectrl runtime dependency, kept explicit here for bring-up use).
-IMAGE_INSTALL:append = " grblhal-glowforge forgectrl v4l-utils"
+IMAGE_INSTALL:append = " grblhal-glowforge forgectrl gfhome v4l-utils"