Phase 10A/10B Inc 0: build system, handle model, first module surface

Builds n3xd-ocp end to end and publishes 7.9.3.1.dev1 to the Gitea registry,
where it installs anonymously and passes its suite.

- occt/Dockerfile: OCCT 7.9.3 compiled once into a manylinux_2_28 builder
  image (base digest + tarball sha256 pinned), Draw/VTK/Tk/Xlib/OpenGL off,
  FreeType on, -O2 without fast-math or march=native. A final layer asserts
  TKService/TKV3d exist with no libGL/libX11 DT_NEEDED, which is what lets the
  app image drop libgl1/libx11-6. Mounted into, never built FROM.
- scikit-build-core + nanobind STABLE_ABI -> one cp312-abi3 extension that
  registers every OCP.* submodule via PyImport_AddModule, so `import
  OCP.TopoDS` needs no shim and cls.__module__ is right. Version <occt>.N is
  asserted against the OCCT found, keeping occt_version() truthful.
- occt_handle.h: type caster for opencascade::handle<T> over OCCT's intrusive
  refcount. Wrappers are non-owning instances holding exactly one handle in
  their keep-alive list, reusing an existing wrapper so identity survives a
  round trip. Transient constructors go through ocp_new (never nb::init<>,
  which would let OCCT delete nanobind's storage); the caster refuses a
  refcount-0 object rather than corrupt the heap. Verified under ASAN with no
  memory-safety errors, plus an RSS bound over 50k create/destroy cycles.
- Sub-shapes are returned by value everywhere, making the TShape lifetime class
  that segfaulted a process-global face memo unrepresentable.
- Standard_Failure derives RuntimeError, with ~20 concrete types dispatched on
  the dynamic OCCT type (cad_pool marshals failures home by type name).
- Inc 0 surface: gp subset, TopAbs, TopoDS (+ downcasts), TopExp, TopLoc,
  TopTools, BRep, BinTools, Poly, Standard. 34 of the app's 139 symbols.
- n3xd_ocp: additive APIs kept out of the OCP namespace so parity testing stays
  meaningful. bintools (shape <-> bytes, GIL-free, byte-identical) and _debug.

Two findings worth the record, both verified against the stock wheel rather
than assumed: upstream binds __hash__ but leaves __eq__ at identity, which is
exactly what geom_memo.py's hash-bucket + IsSame scan is built around, so we
match it instead of "fixing" it; and BinTools can release the GIL after all, by
slurping the file-like object instead of bridging a streambuf that would call
back into Python.

Gate: BREP round-trips are byte-identical to cadquery-ocp-novtk across six
fixtures (the generator asserts stock idempotency first). That matters beyond
IPC — derive.py content-addresses BREP payloads by sha256 and stores the ref.

pyproject.toml

@@ -0,0 +1,46 @@
+[build-system]
+requires = ["scikit-build-core>=0.11", "nanobind>=2.7"]
+build-backend = "scikit_build_core.build"
+
+[project]
+name = "n3xd-ocp"
+# <occt-version>.N, so the kernel a wheel wraps is readable from its version
+# alone and occt_version() keeps reporting the truth.  Iteration builds carry a
+# .devN suffix: the registry never allows republishing a version, and its
+# cleanup rule collects only the dev ones.  CMake asserts the prefix matches
+# the OCCT it found.
+version = "7.9.3.1.dev1"
+description = "nanobind bindings for the OpenCASCADE geometry kernel (drop-in OCP)"
+readme = "README.md"
+requires-python = ">=3.12"
+license = { text = "LGPL-2.1-only" }
+authors = [{ name = "N3XD" }]
+classifiers = [
+    "Private :: Do Not Upload",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: C++",
+]
+
+[project.urls]
+Repository = "https://git.stroblme.de/N3XD/ocp"
+
+[tool.scikit-build]
+minimum-version = "0.11"
+build-dir = "build/{wheel_tag}"
+wheel.packages = ["python/OCP", "python/n3xd_ocp"]
+# Stubs are generated during the build and gitignored, and file selection is
+# git-based by default — so they must be re-included by hand or the wheel ships
+# without the typing surface that retires the backend's ty suppression.
+sdist.include = ["python/OCP/*.pyi", "python/n3xd_ocp/*.pyi"]
+# abi3 from day one, matching the forge/assay convention: one wheel spans 3.12
+# and 3.13, so the interpreter bump (roadmap 10D) needs no rebuild here.
+wheel.py-api = "cp312"
+# No sdist is ever published — it could not build without the OCCT builder
+# image, and offering one would invite the production host (4 cores) to try.
+# That is enforced by only ever building wheels (scripts/build_wheel.sh) rather
+# than by an exclude rule here: scikit-build-core feeds sdist.exclude into the
+# wheel's package-file mapping too, so excluding "*" silently ships a wheel
+# with the compiled extension and none of the Python package.
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]