gplan.so: build from source using Raspbian Stretch Docker

Use balenalib/raspberry-pi-debian:stretch with legacy.raspbian.org repos.
Exact match: GCC 6.3, Python 3.5, GLIBC 2.24 — identical to the Pi.
First build ~25min (QEMU), subsequent builds ~1sec (cached image).

Replaces the broken Bullseye approach that had GLIBC/GLIBCXX mismatches.

.pi/BUILD.md

@@ -54,23 +54,35 @@ ELF 32-bit LSB shared object, ARM, EABI5  (linked against libpython3.5m.so.1.0)
 ```
 If you see `ELF 64-bit LSB shared object, ARM aarch64` or `libpython3.9` — wrong.
 
-**Option A: From official release (recommended)**
+**Option A: Build from source (recommended)**
+
+Uses a Raspbian Stretch Docker image that exactly matches the Pi's toolchain:
+GCC 6.3, Python 3.5, GLIBC 2.24. No cross-compile hacks, no ABI mismatches.
+
+```bash
+.pi/build-gplan.sh
+```
+
+- First run: ~25min (builds `onefin-gplan` Docker image with pre-compiled cbang + camotics)
+- After that: ~1sec (copies cached `gplan.so` from image)
+- Force rebuild: `docker rmi onefin-gplan && .pi/build-gplan.sh`
+
+See `.pi/Dockerfile.gplan` for the full build recipe.
+
+**Option B: From official release**
 
 ```bash
 curl -sL https://github.com/OneFinityCNC/onefinity-firmware/releases/download/v1.6.6/onefinity-1.6.6.tar.bz2 \
   | tar xjf - --include='*/gplan.so' -O > src/py/camotics/gplan.so
 ```
 
-The gplan.so is pure G-code planning with no version-specific code — safe to
-reuse across firmware versions.
-
-**Option B: From a working Pi**
+**Option C: From a working Pi**
 
 ```bash
 scp bbmc@10.1.10.55:/usr/local/lib/python3.5/dist-packages/bbctrl-*.egg/camotics/gplan.so src/py/camotics/
 ```
 
-**Option C: Build from source (broken — documented for reference)**
+**Failed approach: Debian Bullseye armhf (documented for reference)**
 
 Uses Docker's armv7 QEMU emulation on Apple Silicon. Requires a one-time
 copy of Python 3.5 headers from the Pi (~1.7MB):
@@ -142,10 +154,9 @@ Stretch has GLIBC_2.24 / GLIBCXX_3.4.22 max. Even with `-static-libstdc++
 -static-libgcc`, glibc symbols like `GLIBC_2.29` leak through the object
 files compiled against Bullseye headers.
 
-To truly build from source you'd need a Stretch armhf container — but
-Stretch's archived repos have broken package metadata that prevents
-installing build-essential + scons. The official gplan.so was built
-in a Raspbian Stretch chroot (see `scripts/gplan-init-build.sh`).
+The solution was to use `balenalib/raspberry-pi-debian:stretch` with
+`legacy.raspbian.org` repos — these still work unlike bare `debian:stretch`.
+See `.pi/Dockerfile.gplan`.
 
 **Key Pi constraints for native code:**
 - GLIBC ≤ 2.24 (Stretch)