feat(irv-ml1): containerise OrcaSlicer for Draupnir's sliceability check

Not tidiness — necessity, established by ldd rather than assumed. Every
OrcaSlicer release ships only an Ubuntu 24.04 AppImage, which needs GLIBC_2.38
and GLIBCXX_3.4.32. irv-ml1 is Debian 12 on glibc 2.36. That gap is not
installable without moving the host to Debian 13, which is not a thing to do to
a box running twelve GPU and audio services in order to slice a plate.

Reaching back to an Orca built for Ubuntu 22.04 would run, and would mean
pinning permanently to a stale build -- the exact trap brokkr-smithy-dev
rejected when they chose Orca over an old PrusaSlicer tag. The container keeps
the slicer current AND leaves the host alone, which is the same argument that
made FreeCAD an AppImage, taken one step further because the host could not
satisfy this one at all.

The AppImage is extracted at BUILD time; --appimage-extract-and-run re-extracts
to /tmp on every invocation, which is wasted seconds and wasted disk per slice.
~/bin/orca-slice wraps it so the dispatcher calls a binary and the artifact root
is mounted at the same path inside and out.

⚠ Recorded honestly: I installed libwebkit2gtk-4.1-0 and 8 dependencies on the
host chasing errors serially before enumerating with ldd, and only then found
the glibc wall behind them. Those nine packages are unnecessary. Left in place
rather than autoremoved on a box running production services; flagged for the
operator.

services/draupnir-slicer/Dockerfile

@@ -0,0 +1,28 @@
+# OrcaSlicer CLI for the Draupnir sliceability check.
+#
+# ⚠ THIS IS A CONTAINER BECAUSE THE HOST CANNOT RUN IT, not for tidiness.
+# irv-ml1 is Debian 12 (glibc 2.36). Every OrcaSlicer release ships only an
+# Ubuntu 24.04 AppImage, which needs GLIBC_2.38 and GLIBCXX_3.4.32 — verified
+# by ldd, not assumed. That gap is not installable on Debian 12 without moving
+# the whole host to Debian 13, which is not a thing to do to a box running
+# twelve GPU and audio services in order to slice a plate.
+#
+# Reaching back to an OrcaSlicer built for Ubuntu 22.04 would work and would
+# mean pinning permanently to a stale build — the exact trap brokkr-smithy-dev
+# rejected when choosing Orca over an old PrusaSlicer tag. A container keeps
+# the slicer current AND leaves the host untouched.
+FROM ubuntu:24.04
+ARG ORCA_VERSION=2.4.2
+ARG ORCA_URL=https://github.com/OrcaSlicer/OrcaSlicer/releases/download/v2.4.2/OrcaSlicer_Linux_AppImage_Ubuntu2404_V2.4.2.AppImage
+RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+      ca-certificates curl libwebkit2gtk-4.1-0 libglu1-mesa libmspack0 \
+      libsm6 libice6 libxtst6 libgtk-3-0 \
+ && rm -rf /var/lib/apt/lists/*
+# Extract once at build time: --appimage-extract-and-run re-extracts to /tmp on
+# EVERY invocation, which is wasted seconds and wasted disk per slice.
+RUN curl -sL -o /tmp/orca.AppImage "$ORCA_URL" \
+ && chmod +x /tmp/orca.AppImage \
+ && cd /opt && /tmp/orca.AppImage --appimage-extract >/dev/null \
+ && mv squashfs-root orca && rm -f /tmp/orca.AppImage
+ENV LD_LIBRARY_PATH=/opt/orca/usr/lib
+ENTRYPOINT ["/opt/orca/bin/orca-slicer"]