P5a plan: PDF documents — seven Ornith tasks with acceptance tests first

docs/plans/p5a: 01 kind+fetch limits, 02 pdftext child + runner, 03 dcache PDF tables,
04 pdfpool, 05 pdfdoc render (map/pages/grep), 06 api, 07 digest citations, metrics, CLI,
skill, unit, README. Given tests compile against a panic-only skeleton and fail there for the
intended reasons; PDFs for tests are built by internal/pdftest (given), plus two qpdf-encrypted
fixtures.

Owner changes for the run: vendor go-pdfkit/extract v0.3.0 + reader v0.6.0 (pinned via
tools.go until task 02); AGENTS.md, tools/run-plan.sh (enforces a Co-Authored-By trailer for
the model), docs/implementer-log.md, `make gate`; gofmt (whitespace) on clean.go and guard;
TestUnsupportedType uses a zip now that PDFs are supported; requestDeadline 90→210 s and
writeTimeout 120→240 s for the PDF path's worst case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -10,7 +10,7 @@ CGO_ENABLED ?= 0
 GO         ?= go
 STATICCHECK ?= $(shell command -v staticcheck 2>/dev/null)
 
-.PHONY: all build test lint contract install clean
+.PHONY: all build test lint contract install clean gate
 
 all: build
 
@@ -20,6 +20,13 @@ build:
 test:
 	$(GO) test -race ./...
 
+# The implementer's gate (AGENTS.md): formatting, vet, race tests, staticcheck when present. Offline.
+gate:
+	@test -z "$$(gofmt -l cmd internal tests 2>&1)" || { echo "gofmt: these files need formatting:"; gofmt -l cmd internal tests; exit 1; }
+	$(MAKE) lint
+	$(GO) test -race -count=1 ./...
+	@echo "gate: ok"
+
 lint:
 	$(GO) vet ./...
 	@if [ -n "$(STATICCHECK)" ]; then $(STATICCHECK) ./...; else echo "staticcheck not found; skipped"; fi