Move the Design-tab scripts into scripts/CAD/ and name them by role

Requested by SoftFever on PR #15238: ten of these had accumulated loose in
scripts/ next to ~20 unrelated upstream ones, with names that only meant
something to whoever wrote them. They now sit in scripts/CAD/, mirroring the
src/libslic3r/CAD/ and src/slic3r/GUI/CAD/ split, and the verb in the name is
the role: build- produces a binary, start- brings something up, run- runs a
suite, check- asserts one thing against a live app.

  kernel-test.sh        -> CAD/run-kernel-tests.sh
  ladder-all.sh         -> CAD/run-all-checks.sh
  sketch-ladder.py      -> CAD/check-sketch-engine.py
  ladder-corpus.py      -> CAD/check-sketch-engine-corpus.py
  gui-ladder.py         -> CAD/check-gui-sketching.py
  offer-ladder.py       -> CAD/check-gui-context-menu.py
  mcp-sketch-smoke.py   -> CAD/check-mcp-sketch.py
  rig-build.sh          -> CAD/build-gui.sh
  docker-iter-build.sh  -> CAD/build-gui-incremental.sh
  gui-session.sh        -> CAD/start-headless-gui.sh

"Ladder" was the worst of them: it named the shape of the test (rungs of
increasing difficulty) rather than what the test proves, so nothing in the
directory listing told you which one needed a GPU and which was pure kernel.

Every reference rewritten -- the docs, the cross-calls between the scripts,
Dockerfile.deps, and the container-side /OrcaSlicer/scripts paths. The three
shell scripts resolve REPO relative to themselves and now sit one level
deeper, so that walk went from /.. to /../.. . The copies these push into a
container's /tmp were renamed to match, or the container would have kept the
old names alive.

Two runtime paths deliberately NOT renamed. /tmp/orca-rig-build.lock is a
cross-fork contract -- both forks take the same lock so two concurrent builds
serialise instead of OOMing the box, and renaming it on one side silently
removes that guard. /tmp/gui-session.log is a runtime artefact, not a script.

Added scripts/CAD/README.md: what each script proves, what it needs, and the
two constraints that have each cost a session (never build inside the GUI
container; a window manager is required or synthetic keys are ignored).

On CI, which was the other half of the request: the kernel suite is already
there and always has been. The cases are registered in
tests/libslic3r/CMakeLists.txt under if (SLIC3R_CAD), which defaults ON and no
workflow turns off, so they build into libslic3r_tests and run under ctest on
every platform via unit_tests.yml -- like any other unit test, needing no new
job. They have simply never been seen to run, because the workflows on this PR
are still awaiting maintainer approval. run-kernel-tests.sh is the local loop
over the same cases, and it is the only script here CI could run: the other
six need an OpenGL canvas and synthetic input.

Verified: scripts/CAD/run-kernel-tests.sh from its new location, all tests
passed, 2562 assertions in 190 test cases.

scripts/CAD/run-all-checks.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Every ladder, in one command, as the gate before a push that touched the Design tab.
+#
+# WHY A SCRIPT AND NOT CI. Three of the four rungs need a running application with an OpenGL
+# canvas and synthetic input; GitHub's runners have neither. So the gate is local and explicit:
+# run this, read the last line, and do not push a red one. The kernel suite is the only part CI
+# can carry, and it already does.
+#
+#   scripts/CAD/run-all-checks.sh                 # kernel + engine + corpus (every 20th) + gestures + offer
+#   FULL=1 scripts/CAD/run-all-checks.sh          # corpus over ALL 997 sheets (~25 min)
+#   SKIP_GUI=1 scripts/CAD/run-all-checks.sh      # kernel only, for a machine with no rig
+#
+# The rig container is expected to be up with the app running and SNAPORCA_MCP set; bring it up
+# with scripts/CAD/start-headless-gui.sh inside it. The corpus lives at /corpus in that container.
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+
+C="${C:-snaporca-gui}"
+CORPUS="${CORPUS:-/corpus}"
+STEP="${STEP:-20}"
+[ -n "${FULL:-}" ] && STEP=1
+fail=0
+
+step() {
+    local name="$1"; shift
+    echo
+    echo "=== $name ==="
+    if "$@"; then echo "--- $name OK"; else echo "--- $name FAILED"; fail=1; fi
+}
+
+# SC2329: every call goes through step(), which invokes it via "$@", so shellcheck
+# cannot see the callers below.
+# shellcheck disable=SC2329
+run_in_rig() {                      # copy the script in fresh, then run it there
+    docker cp "$1" "$C:/tmp/$(basename "$1")" >/dev/null || return 1
+    shift
+    docker exec "$C" python3 "$@"
+}
+
+# FIRST, and it needs no rig: the offer table the menu is compiled from must be what the atlas
+# says. The header calls itself GENERATED and had been hand-edited anyway — which cost four rows
+# that existed only in the header, one row wired to the wrong action, and a count of 91 for a
+# 92-row array, so the last verb was unreachable (snaporca-z8rs, snaporca-ziam).
+step "offer table matches the atlas" python3 docs/ux/mockups/gen_offer_table.py --check
+
+step "kernel suite" scripts/CAD/run-kernel-tests.sh --vol "${KVOL:-snaporca_kerneltest}"
+
+if [ -z "${SKIP_GUI:-}" ]; then
+    step "engine ladder (rungs 1-8, scripted geometry)" \
+        run_in_rig scripts/CAD/check-sketch-engine.py /tmp/check-sketch-engine.py
+    step "corpus rung (real drawings, every ${STEP}th)" \
+        run_in_rig scripts/CAD/check-sketch-engine-corpus.py /tmp/check-sketch-engine-corpus.py --corpus "$CORPUS" --step "$STEP"
+    step "corpus scale rung (the heaviest sheets)" \
+        run_in_rig scripts/CAD/check-sketch-engine-corpus.py /tmp/check-sketch-engine-corpus.py --corpus "$CORPUS" --scale
+    step "gesture ladder (mouse and keyboard)" \
+        run_in_rig scripts/CAD/check-gui-sketching.py /tmp/check-gui-sketching.py
+    # The offer ladder needs TWO extra things the others do not: the app must have been launched
+    # with SNAPORCA_KEYTRACE=1 (its [OFFER] lines are the whole instrument), and it reads the
+    # generated offer table to predict what each selection should show — which is not in the
+    # container's own baked source tree, so it is copied in beside the script — /tmp, where
+    # run_in_rig puts the script, is one of the paths the ladder looks in.
+    docker cp src/slic3r/GUI/CAD/DesignOffer.hpp "$C:/tmp/DesignOffer.hpp" >/dev/null
+    step "offer ladder (right-click, the menu, the verbs behind it)" \
+        run_in_rig scripts/CAD/check-gui-context-menu.py /tmp/check-gui-context-menu.py
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then echo "ALL LADDERS HELD"; else echo "AT LEAST ONE LADDER FAILED"; fi
+exit "$fail"