[MasoudMiM]

Why

The geometry core is covered by the headless pytest matrix, but the thin FreeCAD adapter (the PartDesign executor) can only be exercised inside FreeCAD itself. Issues #3-#8 were all field-discovered executor regressions the core suite cannot see. This adds a second CI job that runs the full smoke test in a real FreeCAD build on every push and PR.

What

• CI: freecad-smoke job — FreeCAD 1.1.4 AppImage (sha256-verified, cached), core deps installed into FreeCAD's interpreter via AppRun python -m pip, smoke test run under freecadcmd. Because freecadcmd exits 0 even when a script raises (it prints "Exception while processing file" and swallows the failure), the step additionally requires the script's ALL CHECKS PASSED / FAILED: sentinel in the log.
• freecad_smoke_test.py hardening (found while wiring up CI):
  • per-check stdout flush — freecadcmd drops unflushed Python stdout on sys.exit(), which would hide every [PASS]/[FAIL] line in the CI log;
  • duplicate-invocation guard now exits non-zero — freecadcmd processes a .py arg as a module import and only falls back to re-executing the file if that import raises, so reaching the guard means the first run failed (it could formerly be swallowed into a green exit);
  • addon-import failures print their root-cause traceback and a repository-location hint instead of being hidden behind the silent fallback.
• ROADMAP.md — phased plan after v0.17.7: Phase 1 executor CI (this PR), Phase 2 feature depth (convex cones → spheres → tori), Phase 3 per-feature deviation report, Phase 4 dimensioned/constrained sketches, plus deferred items with reasons.
• Dependency/doc sync — pyproject.toml runtime deps now include shapely/rtree (they were dev-only extras while the workbench's runtime gate and README already required them); README test count (500+), project layout, and CI description updated; CHANGELOG Unreleased section; VERIFY.md notes the AppImage baseline is now CI-gated.

Verification

• Local run on FreeCAD 1.1.4 AppImage (same build CI uses): 91/91 checks pass, exit 0, ~70 s.
• Failure scenarios verified to fail loudly: injected failed check → exit 1 + FAILED: sentinel; mid-run crash → sentinel absent → CI step fails; script copied out of the repo → visible traceback + exit 1.
• Headless suite: 502 passed, 1 xfailed — no regression vs main.

Note: the new CI job runs on this PR itself, so a green freecad-smoke check here is the first in-CI validation of the whole recipe.