P5a plan: PDF documents — seven Ornith tasks with acceptance tests first

docs/plans/p5a: 01 kind+fetch limits, 02 pdftext child + runner, 03 dcache PDF tables,
04 pdfpool, 05 pdfdoc render (map/pages/grep), 06 api, 07 digest citations, metrics, CLI,
skill, unit, README. Given tests compile against a panic-only skeleton and fail there for the
intended reasons; PDFs for tests are built by internal/pdftest (given), plus two qpdf-encrypted
fixtures.

Owner changes for the run: vendor go-pdfkit/extract v0.3.0 + reader v0.6.0 (pinned via
tools.go until task 02); AGENTS.md, tools/run-plan.sh (enforces a Co-Authored-By trailer for
the model), docs/implementer-log.md, `make gate`; gofmt (whitespace) on clean.go and guard;
TestUnsupportedType uses a zip now that PDFs are supported; requestDeadline 90→210 s and
writeTimeout 120→240 s for the PDF path's worst case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/guard/iana.go

@@ -7,8 +7,9 @@ import "net/netip"
 // rather than decoded. IsGlobalUnicast remains a final gate in CheckAddr.
 //
 // Sources:
-//   https://www.iana.org/assignments/iana-ipv4-special-registry
-//   https://www.iana.org/assignments/iana-ipv6-special-registry
+//
+//	https://www.iana.org/assignments/iana-ipv4-special-registry
+//	https://www.iana.org/assignments/iana-ipv6-special-registry
 var ianaDeny = []struct {
 	prefix netip.Prefix
 	reason string