Initial prototype: shared ChimeraX Linux bundle build machinery

Two-stage Singularity build for compiling third-party ChimeraX bundles on the
RHEL9 lowest-common-denominator (stock GCC 11 / glibc 2.34 / GLIBCXX_3.4.29),
binary-compatible across all of ChimeraX's Linux distributions.

- toolchain.def     : LCD compiler image (rockylinux:9), mirrors ChimeraX's rhel-9.def
- chimerax.def.in   : thin per-ChimeraX layer (localimage bootstrap, dnf install RPM)
- build-toolchain   : build the toolchain image (rare)
- refresh-chimerax  : ingest an RPM, assert el9/GCC-11, rebuild the thin layer
- cxmake            : run 'make <targets>' for a bundle in the matching container

Bundle-agnostic: serves chimerax-clipper, ISOLDE, ChimeraX-QScore from one toolchain.
Intended as a prototype for vendoring into ChimeraX itself.
