Phase 10A/10B Inc 0: build system, handle model, first module surface

Builds n3xd-ocp end to end and publishes 7.9.3.1.dev1 to the Gitea registry,
where it installs anonymously and passes its suite.

- occt/Dockerfile: OCCT 7.9.3 compiled once into a manylinux_2_28 builder
  image (base digest + tarball sha256 pinned), Draw/VTK/Tk/Xlib/OpenGL off,
  FreeType on, -O2 without fast-math or march=native. A final layer asserts
  TKService/TKV3d exist with no libGL/libX11 DT_NEEDED, which is what lets the
  app image drop libgl1/libx11-6. Mounted into, never built FROM.
- scikit-build-core + nanobind STABLE_ABI -> one cp312-abi3 extension that
  registers every OCP.* submodule via PyImport_AddModule, so `import
  OCP.TopoDS` needs no shim and cls.__module__ is right. Version <occt>.N is
  asserted against the OCCT found, keeping occt_version() truthful.
- occt_handle.h: type caster for opencascade::handle<T> over OCCT's intrusive
  refcount. Wrappers are non-owning instances holding exactly one handle in
  their keep-alive list, reusing an existing wrapper so identity survives a
  round trip. Transient constructors go through ocp_new (never nb::init<>,
  which would let OCCT delete nanobind's storage); the caster refuses a
  refcount-0 object rather than corrupt the heap. Verified under ASAN with no
  memory-safety errors, plus an RSS bound over 50k create/destroy cycles.
- Sub-shapes are returned by value everywhere, making the TShape lifetime class
  that segfaulted a process-global face memo unrepresentable.
- Standard_Failure derives RuntimeError, with ~20 concrete types dispatched on
  the dynamic OCCT type (cad_pool marshals failures home by type name).
- Inc 0 surface: gp subset, TopAbs, TopoDS (+ downcasts), TopExp, TopLoc,
  TopTools, BRep, BinTools, Poly, Standard. 34 of the app's 139 symbols.
- n3xd_ocp: additive APIs kept out of the OCP namespace so parity testing stays
  meaningful. bintools (shape <-> bytes, GIL-free, byte-identical) and _debug.

Two findings worth the record, both verified against the stock wheel rather
than assumed: upstream binds __hash__ but leaves __eq__ at identity, which is
exactly what geom_memo.py's hash-bucket + IsSame scan is built around, so we
match it instead of "fixing" it; and BinTools can release the GIL after all, by
slurping the file-like object instead of bridging a streambuf that would call
back into Python.

Gate: BREP round-trips are byte-identical to cadquery-ocp-novtk across six
fixtures (the generator asserts stock idempotency first). That matters beyond
IPC — derive.py content-addresses BREP payloads by sha256 and stores the ref.

src/common/occt_stream.h

@@ -0,0 +1,41 @@
+/*
+    Python file-like <-> std::stream adaptation for BinTools.
+
+    Upstream's signature takes an io.BytesIO, and the app always passes one
+    (cad_pool and derive.py serialise shapes through BytesIO).  Rather than
+    bridge a streambuf that calls back into Python on every chunk, this slurps:
+    read the whole payload first, then hand the kernel a pure C++ stream.
+
+    Two things fall out of that.  It is correct no matter how BinTools seeks
+    inside the stream, and the kernel half touches no Python at all — so the
+    GIL can be released around it, which a callback bridge could not do.  The
+    cost is one extra copy of the BREP bytes, which n3xd_ocp.bintools avoids
+    entirely for the pool paths that care.
+*/
+
+#pragma once
+
+#include <nanobind/nanobind.h>
+
+#include <string>
+
+namespace nb = nanobind;
+
+/// Read a Python file-like object to end of stream.
+inline std::string ocp_slurp(nb::handle stream) {
+    nb::object data = nb::getattr(stream, "read")();
+    char *buf = nullptr;
+    Py_ssize_t size = 0;
+    if (PyBytes_AsStringAndSize(data.ptr(), &buf, &size) != 0)
+        throw nb::python_error();
+    return std::string(buf, (size_t) size);
+}
+
+/// Write a byte payload to a Python file-like object.
+inline void ocp_spit(nb::handle stream, const std::string &data) {
+    nb::object payload = nb::steal(
+        PyBytes_FromStringAndSize(data.data(), (Py_ssize_t) data.size()));
+    if (!payload.is_valid())
+        throw nb::python_error();
+    nb::getattr(stream, "write")(payload);
+}