Phase 10A/10B Inc 0: build system, handle model, first module surface

Builds n3xd-ocp end to end and publishes 7.9.3.1.dev1 to the Gitea registry,
where it installs anonymously and passes its suite.

- occt/Dockerfile: OCCT 7.9.3 compiled once into a manylinux_2_28 builder
  image (base digest + tarball sha256 pinned), Draw/VTK/Tk/Xlib/OpenGL off,
  FreeType on, -O2 without fast-math or march=native. A final layer asserts
  TKService/TKV3d exist with no libGL/libX11 DT_NEEDED, which is what lets the
  app image drop libgl1/libx11-6. Mounted into, never built FROM.
- scikit-build-core + nanobind STABLE_ABI -> one cp312-abi3 extension that
  registers every OCP.* submodule via PyImport_AddModule, so `import
  OCP.TopoDS` needs no shim and cls.__module__ is right. Version <occt>.N is
  asserted against the OCCT found, keeping occt_version() truthful.
- occt_handle.h: type caster for opencascade::handle<T> over OCCT's intrusive
  refcount. Wrappers are non-owning instances holding exactly one handle in
  their keep-alive list, reusing an existing wrapper so identity survives a
  round trip. Transient constructors go through ocp_new (never nb::init<>,
  which would let OCCT delete nanobind's storage); the caster refuses a
  refcount-0 object rather than corrupt the heap. Verified under ASAN with no
  memory-safety errors, plus an RSS bound over 50k create/destroy cycles.
- Sub-shapes are returned by value everywhere, making the TShape lifetime class
  that segfaulted a process-global face memo unrepresentable.
- Standard_Failure derives RuntimeError, with ~20 concrete types dispatched on
  the dynamic OCCT type (cad_pool marshals failures home by type name).
- Inc 0 surface: gp subset, TopAbs, TopoDS (+ downcasts), TopExp, TopLoc,
  TopTools, BRep, BinTools, Poly, Standard. 34 of the app's 139 symbols.
- n3xd_ocp: additive APIs kept out of the OCP namespace so parity testing stays
  meaningful. bintools (shape <-> bytes, GIL-free, byte-identical) and _debug.

Two findings worth the record, both verified against the stock wheel rather
than assumed: upstream binds __hash__ but leaves __eq__ at identity, which is
exactly what geom_memo.py's hash-bucket + IsSame scan is built around, so we
match it instead of "fixing" it; and BinTools can release the GIL after all, by
slurping the file-like object instead of bridging a streambuf that would call
back into Python.

Gate: BREP round-trips are byte-identical to cadquery-ocp-novtk across six
fixtures (the generator asserts stock idempotency first). That matters beyond
IPC — derive.py content-addresses BREP payloads by sha256 and stores the ref.

tests/test_shape_identity.py

@@ -0,0 +1,100 @@
+"""Shape hashing and equality — the contract cad/topology/geom_memo.py rests on.
+
+Verified against the stock wheel before being replicated here: upstream binds
+__hash__ (TShape + Location) and leaves __eq__ at Python's default identity
+comparison.  That pairing is deliberate on our side too.  geom_memo buckets on
+hash(face) and disambiguates with IsSame precisely because == cannot be
+trusted; binding __eq__ to IsEqual would collapse entries that memo expects to
+keep apart, changing behaviour while looking like an improvement.
+"""
+
+from __future__ import annotations
+
+from OCP.gp import gp_Trsf, gp_Vec
+from OCP.TopAbs import TopAbs_EDGE, TopAbs_FACE
+from OCP.TopExp import TopExp
+from OCP.TopLoc import TopLoc_Location
+from OCP.TopTools import TopTools_IndexedMapOfShape
+
+
+def _faces(shape):
+    faces = TopTools_IndexedMapOfShape()
+    TopExp.MapShapes_s(shape, TopAbs_FACE, faces)
+    return faces
+
+
+def test_re_extracted_face_hashes_equal_and_is_same(fixture_shapes):
+    shape = fixture_shapes["box"]
+    f1 = _faces(shape).FindKey(1)
+    f2 = _faces(shape).FindKey(1)
+
+    assert f1 is not f2  # separate extractions, separate wrappers
+    assert hash(f1) == hash(f2)
+    assert f1.IsSame(f2)
+    assert f1.IsEqual(f2)
+
+
+def test_eq_is_identity_not_isequal(fixture_shapes):
+    shape = fixture_shapes["box"]
+    f1 = _faces(shape).FindKey(1)
+    f2 = _faces(shape).FindKey(1)
+
+    # Matches the stock wheel: equal hashes, unequal objects.
+    assert f1 != f2
+    assert f1 == f1
+
+
+def test_moved_copy_hashes_differently(fixture_shapes):
+    trsf = gp_Trsf()
+    trsf.SetTranslation(gp_Vec(1.0, 0.0, 0.0))
+
+    face = _faces(fixture_shapes["box"]).FindKey(1)
+    moved = face.Moved(TopLoc_Location(trsf))
+
+    assert hash(moved) != hash(face)
+    assert not face.IsSame(moved)
+
+
+def test_orientation_is_not_part_of_the_hash(fixture_shapes):
+    # Area and centre of mass are orientation-independent, which is why the
+    # memo's key needs no orientation component.
+    face = _faces(fixture_shapes["box"]).FindKey(1)
+    reversed_face = face.Reversed()
+
+    assert hash(reversed_face) == hash(face)
+    assert face.IsSame(reversed_face)
+    assert not face.IsEqual(reversed_face)
+
+
+def test_subshapes_outlive_their_container(fixture_shapes):
+    """The lifetime class that segfaulted a process-global face memo."""
+    faces = _faces(fixture_shapes["fused"])
+    picked = [faces.FindKey(i) for i in range(1, faces.Extent() + 1)]
+    del faces
+
+    # Every wrapper owns its own copy, so the map's death is irrelevant.
+    assert all(not f.IsNull() for f in picked)
+    assert len({hash(f) for f in picked}) == len(picked)
+
+
+def test_explorer_results_outlive_the_explorer(fixture_shapes):
+    from OCP.TopExp import TopExp_Explorer
+
+    exp = TopExp_Explorer(fixture_shapes["box"], TopAbs_EDGE)
+    edges = []
+    while exp.More():
+        edges.append(exp.Current())
+        exp.Next()
+    del exp
+
+    assert len(edges) == 24  # a box: 12 edges, each shared by two faces
+    assert all(not e.IsNull() for e in edges)
+
+
+def test_indexed_map_contains_uses_is_same(fixture_shapes):
+    shape = fixture_shapes["box"]
+    faces = _faces(shape)
+    other = _faces(shape).FindKey(3)
+
+    assert faces.Contains(other)
+    assert faces.FindIndex(other) == 3