feat: execute isolated Bambu Studio slices

[kforris]

Problem

Relates to #1.

OpenPrintBench could build a portable, shell-free plan but could not execute an
explicitly approved Bambu Studio slice or preserve run evidence. Bare STL
execution also needs complete profiles; Bambu Studio's installed leaf profiles
retain inherits/include references and are not sufficient CLI inputs by
themselves.

What changed

• add a project-authored CC0 20 mm cube fixture with source/license metadata;
• require --approve, pinned fixture/profile provenance, and a new private run
  directory;
• run Bambu Studio with an argument array and shell=False under isolated
  HOME, temp, and XDG paths, with secret-like environment keys removed;
• materialize complete machine/process/filament JSON from the installed BBL
  profile inheritance tree without committing profiles;
• record version, input/settings hashes, duration, exit status, timeout state,
  output hashes, redacted log hash, and physical_validation: null;
• document two successful Bambu Studio 02.06.00.51 runs. Their G-code SHA-256
  matched; timing, log timestamps, result timing fields, and 3MF container
  hashes varied.

Generated 3MF/G-code remains local and is not included in this PR.

Evidence state

• Probe
• Plan
• Run
• Physical validation

Digital run evidence:
docs/evidence/2026-07-28-bambu-stl-repeatability.md

Validation

• uv lock --check
• uv run ruff check .
• uv run ruff format --check .
• uv run mypy src
• uv run pytest -q --cov=openprintbench --cov-report=term-missing
• uv build
• git diff --check

Result: 45 passed, 0 skipped/xfail, 87.38% branch coverage.

Privacy and provenance

• No credentials, serials, usernames, or absolute home paths are included.
• Every fixture and referenced profile has explicit redistribution terms
  (CC0-1.0 fixture; AGPL-3.0-only installed profile source).
• No slicer binary or proprietary network plugin is redistributed or
  invoked.