perf(build): 4h05m -> 1h15m full CI build — docker caps, pipelined wasm-opt, Binaryen 130

Three orchestration fixes, validated end-to-end on the Hetzner ccx53
(run 27280051992, 1h14m41s vs 4h05m baseline, e2e identical):

- docker-compose CPU/memory caps were hardcoded to dev-Mac defaults
  (10 CPUs / 32G); now env-tunable via KICAD_DOCKER_CPUS/KICAD_DOCKER_MEM
  (CI exports nproc/110G — the 32-core runner was compiling on 10 cores).
- docker/build.sh: split build_app into compile_app (container) +
  postprocess_app (host-side dyncall shims + finalize + asyncify + -O2)
  and added KICAD_PIPELINE=1 mode that overlaps each tool's host-side
  wasm-opt with the next tool's container compile (max 2 concurrent
  postprocesses — pcbnew -O2 peaks ~34G RSS). Also: comma-separated app
  lists for cheap pipeline repros.
- get-wasm-opt.sh: Binaryen default 121 -> 130 (fixes the v121 -O2 lock
  convoy, ~9x) and BINARYEN_BUILD_FROM_SOURCE=1 support: the official
  x86_64-linux release tarballs (Alpine/musl, no LTO, assertions on) run
  asyncify 4x slower than a stock gcc -O3+LTO build with sha256-identical
  output; self-build takes ~5 min and is instantly repaid.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker/docker-compose.yml

@@ -5,12 +5,15 @@ services:
       dockerfile: docker/Dockerfile
     # Container name is auto-generated with project prefix (set in build.sh)
 
-    # Resource limits (adjust based on your machine)
+    # Resource limits. Defaults are sized for a dev Mac (Docker Desktop VM).
+    # CI overrides via env: the 32-core Hetzner runner sets KICAD_DOCKER_CPUS=$(nproc)
+    # and KICAD_DOCKER_MEM=110G — with the 10-CPU default, run 27226030304 compiled
+    # everything on 10 of 32 cores while passing -j 32 (3x oversubscribed).
     deploy:
       resources:
         limits:
-          cpus: '10'
-          memory: 32G
+          cpus: '${KICAD_DOCKER_CPUS:-10}'
+          memory: ${KICAD_DOCKER_MEM:-32G}
 
     volumes:
       # Host source mounted read-only at staging location