test(editor): validate and round-trip edited PDF outputs before publish

[McanKul]

Goal

Add a fail-closed validation gate for staged Edit PDF outputs before they replace the requested destination file.

This protects the current overlay editor and is required before any existing-content mutation can ship.

Scope

• Run qpdf --check against the staged output and classify warnings versus fatal errors.
• Reopen the staged PDF and verify:
  • page count and selected page order
  • MediaBox, CropBox, TrimBox, /Rotate, and /UserUnit
  • required catalog structures such as outlines, metadata, AcroForm, and unrelated annotations
• Add targeted text-extraction and render round trips for fixtures whose visible or searchable content is expected to change.
• Delete failed staging output and leave both the source and existing destination untouched.
• Keep validation bounded and cancellable.

Acceptance criteria

• Validation completes before the atomic destination rename.
• A malformed or truncated staged PDF fails with an actionable error and is never published.
• A failed validation cannot truncate the source, a hard-linked path, or an existing destination.
• Current overlay exports, rotated/cropped pages, annotations, forms, and source catalog preservation have integration coverage.
• Tests include a deliberately invalid staged output and prove cleanup.
• The validation result is suitable for reuse by annotations, forms, redaction, and future direct text/image editing.

Out of scope

• Treating pixel equality as the only correctness check.
• Hiding qpdf warnings without a documented policy.

[McanKul]

Resolved by #54 and merged into development after the updated validation and integration coverage passed review.