BentoPDF for bau-pm, without third-party hosts (bau-pm BAU-119)

BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own
air-gapped build options, every module it would load from a CDN vendored and
checked against vendor.lock, a Content-Security-Policy without a single host,
digital-sign-pdf and timestamp-pdf disabled because both need a third party,
and the hand-off glue on every page: the AGPL source link, the hand-in of a
file from bau-pm through a one-minute cookie into sessionStorage, confirmed by
the tool's reaction, the hand-back of a result from every window, and the
signing tool's flatten switch locked on.

The zero-host gate drives all 117 enabled tool pages in Chromium and fails on
any request to another origin, any CSP violation, a CSP that names a host, and
a disabled id that names no page. Green on this image (3 min 52 s on a private
network), red on the stock upstream image (115 findings) and on a misspelled
id. CI runs it on every push, the release workflow before it pushes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.markdownlint.jsonc

@@ -0,0 +1,8 @@
+// markdownlint rules (bau-pm BAU-110), read by scripts/lint-md.sh. Managed by
+// the bau-pm plugin kit (templates/plugin/): change it there, not here.
+{
+  // Markdown is never hard-wrapped here: one paragraph per line.
+  "MD013": false,
+  // Keep a Changelog repeats "### Added" / "### Fixed" under every release.
+  "MD024": { "siblings_only": true }
+}