Phase 10A/10B Inc 0: build system, handle model, first module surface

Builds n3xd-ocp end to end and publishes 7.9.3.1.dev1 to the Gitea registry,
where it installs anonymously and passes its suite.

- occt/Dockerfile: OCCT 7.9.3 compiled once into a manylinux_2_28 builder
  image (base digest + tarball sha256 pinned), Draw/VTK/Tk/Xlib/OpenGL off,
  FreeType on, -O2 without fast-math or march=native. A final layer asserts
  TKService/TKV3d exist with no libGL/libX11 DT_NEEDED, which is what lets the
  app image drop libgl1/libx11-6. Mounted into, never built FROM.
- scikit-build-core + nanobind STABLE_ABI -> one cp312-abi3 extension that
  registers every OCP.* submodule via PyImport_AddModule, so `import
  OCP.TopoDS` needs no shim and cls.__module__ is right. Version <occt>.N is
  asserted against the OCCT found, keeping occt_version() truthful.
- occt_handle.h: type caster for opencascade::handle<T> over OCCT's intrusive
  refcount. Wrappers are non-owning instances holding exactly one handle in
  their keep-alive list, reusing an existing wrapper so identity survives a
  round trip. Transient constructors go through ocp_new (never nb::init<>,
  which would let OCCT delete nanobind's storage); the caster refuses a
  refcount-0 object rather than corrupt the heap. Verified under ASAN with no
  memory-safety errors, plus an RSS bound over 50k create/destroy cycles.
- Sub-shapes are returned by value everywhere, making the TShape lifetime class
  that segfaulted a process-global face memo unrepresentable.
- Standard_Failure derives RuntimeError, with ~20 concrete types dispatched on
  the dynamic OCCT type (cad_pool marshals failures home by type name).
- Inc 0 surface: gp subset, TopAbs, TopoDS (+ downcasts), TopExp, TopLoc,
  TopTools, BRep, BinTools, Poly, Standard. 34 of the app's 139 symbols.
- n3xd_ocp: additive APIs kept out of the OCP namespace so parity testing stays
  meaningful. bintools (shape <-> bytes, GIL-free, byte-identical) and _debug.

Two findings worth the record, both verified against the stock wheel rather
than assumed: upstream binds __hash__ but leaves __eq__ at identity, which is
exactly what geom_memo.py's hash-bucket + IsSame scan is built around, so we
match it instead of "fixing" it; and BinTools can release the GIL after all, by
slurping the file-like object instead of bridging a streambuf that would call
back into Python.

Gate: BREP round-trips are byte-identical to cadquery-ocp-novtk across six
fixtures (the generator asserts stock idempotency first). That matters beyond
IPC — derive.py content-addresses BREP payloads by sha256 and stores the ref.

tools/parity_venv.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Set up a side environment where the app runs against n3xd-ocp instead of the
+# stock wheel.
+#
+# The app's manifests are never touched: a swap is per-environment because both
+# distributions own the OCP/ import path and a process can hold only one OCCT
+# build.  main therefore keeps resolving cadquery-ocp-novtk until the Phase 10C
+# cutover, and this venv is how parity is proven in the meantime.
+#
+#   tools/parity_venv.sh            install from the Gitea registry
+#   tools/parity_venv.sh --local    install the local wheelhouse build
+#
+# Then run whichever slice of the app suite the current increment claims:
+#   cd ../app && UV_PROJECT_ENVIRONMENT=.venv-ocp-parity uv run pytest backend/tests/test_geom_memo.py
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+OCP_REPO=$(dirname "$HERE")
+APP="${APP_DIR:-$(dirname "$OCP_REPO")/app}"
+VENV_NAME="${VENV_NAME:-.venv-ocp-parity}"
+INDEX="https://git.stroblme.de/api/packages/N3XD/pypi/simple/"
+
+SOURCE="registry"
+[ "${1:-}" = "--local" ] && SOURCE="local"
+
+cd "$APP"
+export UV_PROJECT_ENVIRONMENT="$VENV_NAME"
+
+echo "--- syncing the app's dependencies into $VENV_NAME ---"
+uv sync --all-groups
+
+# Removal must precede installation: both distributions install a top-level
+# OCP/, so installing over the stock wheel would leave a half-overwritten mix.
+echo "--- removing the stock wheel ---"
+uv pip uninstall cadquery-ocp-novtk || true
+
+echo "--- installing n3xd-ocp ($SOURCE) ---"
+if [ "$SOURCE" = "local" ]; then
+    uv pip install "$OCP_REPO"/wheelhouse/*.whl
+else
+    uv pip install --index-url "$INDEX" --prerelease=allow n3xd-ocp
+fi
+
+echo "--- sanity ---"
+uv run python -c "
+import OCP
+print('OCP', OCP.__version__, '/ OCCT', OCP.__occt_version__)
+print('modules:', len(OCP._OCP.__all_modules__))
+"
+
+echo "--- coverage against the app's symbol inventory ---"
+uv run python "$HERE/inventory.py" --check || \
+    echo "(incomplete coverage is expected until the increments land)"