Phase 10A/10B Inc 0: build system, handle model, first module surface

Builds n3xd-ocp end to end and publishes 7.9.3.1.dev1 to the Gitea registry,
where it installs anonymously and passes its suite.

- occt/Dockerfile: OCCT 7.9.3 compiled once into a manylinux_2_28 builder
  image (base digest + tarball sha256 pinned), Draw/VTK/Tk/Xlib/OpenGL off,
  FreeType on, -O2 without fast-math or march=native. A final layer asserts
  TKService/TKV3d exist with no libGL/libX11 DT_NEEDED, which is what lets the
  app image drop libgl1/libx11-6. Mounted into, never built FROM.
- scikit-build-core + nanobind STABLE_ABI -> one cp312-abi3 extension that
  registers every OCP.* submodule via PyImport_AddModule, so `import
  OCP.TopoDS` needs no shim and cls.__module__ is right. Version <occt>.N is
  asserted against the OCCT found, keeping occt_version() truthful.
- occt_handle.h: type caster for opencascade::handle<T> over OCCT's intrusive
  refcount. Wrappers are non-owning instances holding exactly one handle in
  their keep-alive list, reusing an existing wrapper so identity survives a
  round trip. Transient constructors go through ocp_new (never nb::init<>,
  which would let OCCT delete nanobind's storage); the caster refuses a
  refcount-0 object rather than corrupt the heap. Verified under ASAN with no
  memory-safety errors, plus an RSS bound over 50k create/destroy cycles.
- Sub-shapes are returned by value everywhere, making the TShape lifetime class
  that segfaulted a process-global face memo unrepresentable.
- Standard_Failure derives RuntimeError, with ~20 concrete types dispatched on
  the dynamic OCCT type (cad_pool marshals failures home by type name).
- Inc 0 surface: gp subset, TopAbs, TopoDS (+ downcasts), TopExp, TopLoc,
  TopTools, BRep, BinTools, Poly, Standard. 34 of the app's 139 symbols.
- n3xd_ocp: additive APIs kept out of the OCP namespace so parity testing stays
  meaningful. bintools (shape <-> bytes, GIL-free, byte-identical) and _debug.

Two findings worth the record, both verified against the stock wheel rather
than assumed: upstream binds __hash__ but leaves __eq__ at identity, which is
exactly what geom_memo.py's hash-bucket + IsSame scan is built around, so we
match it instead of "fixing" it; and BinTools can release the GIL after all, by
slurping the file-like object instead of bridging a streambuf that would call
back into Python.

Gate: BREP round-trips are byte-identical to cadquery-ocp-novtk across six
fixtures (the generator asserts stock idempotency first). That matters beyond
IPC — derive.py content-addresses BREP payloads by sha256 and stores the ref.

tests/test_import.py

@@ -0,0 +1,62 @@
+"""Import surface: every Inc 0 module present, and nothing started a thread."""
+
+import sys
+import threading
+
+import OCP
+
+
+def test_version_and_kernel():
+    assert OCP.__version__.startswith(OCP.__occt_version__), (
+        f"wheel version {OCP.__version__} must be prefixed by the OCCT it "
+        f"wraps ({OCP.__occt_version__})"
+    )
+
+
+def test_every_module_is_importable_and_attribute_reachable():
+    for name in OCP._OCP.__all_modules__:
+        assert f"OCP.{name}" in sys.modules, f"OCP.{name} not in sys.modules"
+        assert getattr(OCP, name) is sys.modules[f"OCP.{name}"]
+
+
+def test_inc0_modules_present():
+    expected = {
+        "Standard", "StdFail", "gp", "TopAbs", "TopLoc", "TopoDS",
+        "TopTools", "TopExp", "Poly", "BRep", "BinTools",
+    }
+    assert expected <= set(OCP._OCP.__all_modules__)
+
+
+def test_classes_report_their_real_module():
+    from OCP.TopoDS import TopoDS_Shape
+
+    # Anything importing OCP.TopoDS expects the class to belong there — a flat
+    # extension namespace would break repr and stub generation alike.
+    assert TopoDS_Shape.__module__ == "OCP.TopoDS"
+
+
+def test_import_starts_no_threads():
+    # cad_pool forks from a forkserver whose preload imports OCP.  A thread
+    # started at import would not survive the fork, so this invariant is what
+    # keeps fillet isolation at ~30 ms per job instead of a ~1.3 s respawn.
+    assert threading.active_count() == 1, threading.enumerate()
+
+
+def test_enums_export_their_values():
+    from OCP.TopAbs import TopAbs_FACE, TopAbs_ShapeEnum
+
+    assert TopAbs_FACE == TopAbs_ShapeEnum.TopAbs_FACE
+    assert int(TopAbs_FACE) == 4  # OCCT's numeric value, relied on by callers
+
+
+def test_static_methods_carry_the_s_suffix():
+    from OCP.BRep import BRep_Tool
+    from OCP.TopExp import TopExp
+    from OCP.TopoDS import TopoDS
+
+    for holder, name in [
+        (TopExp, "MapShapes_s"),
+        (TopoDS, "Face_s"),
+        (BRep_Tool, "Triangulation_s"),
+    ]:
+        assert hasattr(holder, name), f"{holder.__name__}.{name} missing"