Phase 10A/10B Inc 0: build system, handle model, first module surface

Builds n3xd-ocp end to end and publishes 7.9.3.1.dev1 to the Gitea registry,
where it installs anonymously and passes its suite.

- occt/Dockerfile: OCCT 7.9.3 compiled once into a manylinux_2_28 builder
  image (base digest + tarball sha256 pinned), Draw/VTK/Tk/Xlib/OpenGL off,
  FreeType on, -O2 without fast-math or march=native. A final layer asserts
  TKService/TKV3d exist with no libGL/libX11 DT_NEEDED, which is what lets the
  app image drop libgl1/libx11-6. Mounted into, never built FROM.
- scikit-build-core + nanobind STABLE_ABI -> one cp312-abi3 extension that
  registers every OCP.* submodule via PyImport_AddModule, so `import
  OCP.TopoDS` needs no shim and cls.__module__ is right. Version <occt>.N is
  asserted against the OCCT found, keeping occt_version() truthful.
- occt_handle.h: type caster for opencascade::handle<T> over OCCT's intrusive
  refcount. Wrappers are non-owning instances holding exactly one handle in
  their keep-alive list, reusing an existing wrapper so identity survives a
  round trip. Transient constructors go through ocp_new (never nb::init<>,
  which would let OCCT delete nanobind's storage); the caster refuses a
  refcount-0 object rather than corrupt the heap. Verified under ASAN with no
  memory-safety errors, plus an RSS bound over 50k create/destroy cycles.
- Sub-shapes are returned by value everywhere, making the TShape lifetime class
  that segfaulted a process-global face memo unrepresentable.
- Standard_Failure derives RuntimeError, with ~20 concrete types dispatched on
  the dynamic OCCT type (cad_pool marshals failures home by type name).
- Inc 0 surface: gp subset, TopAbs, TopoDS (+ downcasts), TopExp, TopLoc,
  TopTools, BRep, BinTools, Poly, Standard. 34 of the app's 139 symbols.
- n3xd_ocp: additive APIs kept out of the OCP namespace so parity testing stays
  meaningful. bintools (shape <-> bytes, GIL-free, byte-identical) and _debug.

Two findings worth the record, both verified against the stock wheel rather
than assumed: upstream binds __hash__ but leaves __eq__ at identity, which is
exactly what geom_memo.py's hash-bucket + IsSame scan is built around, so we
match it instead of "fixing" it; and BinTools can release the GIL after all, by
slurping the file-like object instead of bridging a streambuf that would call
back into Python.

Gate: BREP round-trips are byte-identical to cadquery-ocp-novtk across six
fixtures (the generator asserts stock idempotency first). That matters beyond
IPC — derive.py content-addresses BREP payloads by sha256 and stores the ref.

Makefile

@@ -0,0 +1,56 @@
+OCCT_VER ?= 7.9.3
+IMG_N    ?= 1
+IMAGE    ?= git.stroblme.de/n3xd/occt-build:$(OCCT_VER)-$(IMG_N)
+# Build cache lives off the root filesystem, which is tight on this host.
+CACHE    ?= /mnt/cache/n3xd/ocp
+REPO     := $(shell pwd)
+PUBLISH_URL ?= https://git.stroblme.de/api/packages/N3XD/pypi
+
+# The builder image is a compiler appliance: mounted into, never built FROM, so
+# iterating on the binding never re-layers the kernel.  $(CACHE) keeps the
+# CMake tree and ccache between runs, which is what makes the inner loop a
+# recompile of one TU rather than a full build.
+DOCKER_RUN = docker run --rm -u $(shell id -u):$(shell id -g) \
+	-v $(REPO):/io -v $(CACHE):/cache -e CACHE_ROOT=/cache $(IMAGE)
+
+.PHONY: help image image-push wheel dev shell test test-asan stubs publish clean clean-cache version parity
+
+help:
+	@grep -E '^[a-z-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "}{printf "  %-14s %s\n", $$1, $$2}'
+
+image: ## Build the OCCT builder image (~40 min; only when occt/Dockerfile changes)
+	docker build -f occt/Dockerfile -t $(IMAGE) occt/
+
+image-push: ## Push the builder image (needs: docker login git.stroblme.de)
+	docker push $(IMAGE)
+
+wheel: ## Build + repair + smoke-test the wheel into wheelhouse/
+	$(DOCKER_RUN) bash /io/scripts/build_wheel.sh
+
+dev: ## Incremental build + run the test suite (the inner loop)
+	$(DOCKER_RUN) bash /io/scripts/in_container_test.sh
+
+test: dev ## Alias for dev
+
+shell: ## Interactive shell in the builder image
+	docker run --rm -it -v $(REPO):/io -v $(CACHE):/cache $(IMAGE) bash
+
+stubs: ## Regenerate .pyi stubs from the built extension
+	$(DOCKER_RUN) bash /io/scripts/stubgen.sh
+
+publish: ## Publish wheelhouse/*.whl to the Gitea package registry
+	@test -f .secrets || { echo "missing .secrets (UV_PUBLISH_USERNAME/PASSWORD)"; exit 1; }
+	set -a; . ./.secrets; set +a; \
+	uv publish --publish-url $(PUBLISH_URL) wheelhouse/*.whl
+
+version: ## Print the wheel version
+	@grep '^version' pyproject.toml | head -1 | cut -d'"' -f2
+
+clean: ## Remove build output (keeps the docker cache volume)
+	rm -rf build dist wheelhouse python/OCP/*.pyi python/n3xd_ocp/*.pyi
+
+clean-cache: ## Drop the persistent build cache
+	rm -rf $(CACHE)/ccache $(CACHE)/skbuild $(CACHE)/pip
+
+test-asan: ## Run the handle tests under AddressSanitizer
+	$(DOCKER_RUN) bash /io/scripts/asan.sh