BentoPDF for bau-pm, without third-party hosts (bau-pm BAU-119)

BentoPDF v2.8.8 built from source at its pinned commit with BentoPDF's own
air-gapped build options, every module it would load from a CDN vendored and
checked against vendor.lock, a Content-Security-Policy without a single host,
digital-sign-pdf and timestamp-pdf disabled because both need a third party,
and the hand-off glue on every page: the AGPL source link, the hand-in of a
file from bau-pm through a one-minute cookie into sessionStorage, confirmed by
the tool's reaction, the hand-back of a result from every window, and the
signing tool's flatten switch locked on.

The zero-host gate drives all 117 enabled tool pages in Chromium and fails on
any request to another origin, any CSP violation, a CSP that names a host, and
a disabled id that names no page. Green on this image (3 min 52 s on a private
network), red on the stock upstream image (115 findings) and on a misspelled
id. CI runs it on every push, the release workflow before it pushes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vendor.lock

@@ -0,0 +1,23 @@
+# Every module BentoPDF would otherwise load from cdn.jsdelivr.net at runtime,
+# pinned by version and by the registry's integrity hash. The Dockerfile's
+# vendor stage packs each one with `npm pack --json` and refuses the build when
+# the integrity it receives differs from the one written here. One line per
+# package: <spec> <integrity>.
+#
+# PyMuPDF (@bentopdf/pymupdf-wasm 0.11.16) and Ghostscript (@bentopdf/gs-wasm
+# 0.1.1) are not listed: BentoPDF ships both tarballs in its own repository
+# (bentopdf-airgap-bundle/), so they come from the pinned commit.
+#
+# Left out on purpose: the CJK fallback fonts of the PDF editor
+# (@embedpdf/fonts-jp, -kr, -sc, -tc, 30 to 42 MB each). A document that needs
+# them asks this server and gets a 404, never a third party.
+coherentpdf@2.5.5 sha512-AAD3RG7lq2n34AtH352sbNDhJ82yfp2vFUp63/+Vu7snAqW0vyvY33XuhZdj6ubZUlFe1DNSSEaYcyc7+jTJ5Q==
+tesseract.js@7.0.0 sha512-exPBkd+z+wM1BuMkx/Bjv43OeLBxhL5kKWsz/9JY+DXcXdiBjiAch0V49QR3oAJqCaL5qURE0vx9Eo+G5YE7mA==
+tesseract.js-core@7.0.0 sha512-WnNH518NzmbSq9zgTPeoF8c+xmilS8rFIl1YKbk/ptuuc7p6cLNELNuPAzcmsYw450ca6bLa8j3t0VAtq435Vw==
+@tesseract.js-data/deu@1.0.0 sha512-3ter1p2gFAiCd5CMC+PodZ9YY2UDomkKj+ytlKeeZqOUmhLx1SDnYPf5zog0g5MBbxYveW+8omI3PUflqHfZ4Q==
+@tesseract.js-data/fra@1.0.0 sha512-pp58gMaoyidoBBLd5y5rnf0WW0Y1994QrGqZrYatITqIU/AReUJMykD+YY3JDgvnmgz7uAx1UmhjjuyEmV8JEA==
+@tesseract.js-data/ita@1.0.0 sha512-Sx19NVYve5VAxEBDL6CWTX+evlvzV+iAS5ejJywcHVsmir/C9Tzw2fExoh97QFc06t48tYZA8VrMobsBzMAEhA==
+@tesseract.js-data/eng@1.0.0 sha512-mbTumm6KQPUHyzTPQaF3ObXYnx0SqqfV2nabqFVQBwD6Kl7PhGSLSzOlfFTWy0P3BjghaSKA2W9GB19Jk+ZcTg==
+@embedpdf/fonts-latin@1.0.0 sha512-LLYysdr8O6sRNzhmW3PbF3AeA8xnqvOi4XLFfIfNlW5uEZ+qsJdcfd78Q78sFJMhlaOAYFMziMMsnOzmx463rA==
+@embedpdf/fonts-arabic@1.0.0 sha512-SnGvQb+LwPZQO2WjjvlmXrJZolJUfLYbLZQSaYUw1vrQyMyJKT4LewvJGG+hZ+Yz2fz7OMIQ+4Gc98mGODZtOg==
+@embedpdf/fonts-hebrew@1.0.0 sha512-5HVAKGL7VqPeTxxADDrSqAFBxfmAXdP8fIqrPwJIKkqdK2643bOer8CqnnpO3/nPoFhkzxhttWMB9BGiqSW62w==