[sec-check] pdf.yml installs Prince via unverified curl download executed with sudo (supply-chain risk)

## Security Finding

**Severity**: low
**Type**: unsafe-pattern / supply-chain hardening

`.github/workflows/pdf.yml` downloads the Prince XML installer at runtime and executes it as root without any integrity verification:

```yaml
- name: Install Prince
run: |
curl https://www.princexml.com/download/prince-15.4.1-linux-generic-x86_64.tar.gz -O
tar zxf prince-15.4.1-linux-generic-x86_64.tar.gz
cd prince-15.4.1-linux-generic-x86_64
yes "" | sudo ./install.sh
```

The job holds `contents: write` and uploads to a GitHub Release (`gh release upload --clobber 0.1`), so a compromised or MITM'd download would run arbitrary code as root with a write-capable `GITHUB_TOKEN` in the environment.

## Impact

If `www.princexml.com` (or the network path to it) were compromised, an attacker-controlled installer would execute with `sudo` inside a workflow holding a `contents:write` token — enabling release-artifact poisoning and repo content tampering.

## Recommendation

- Verify a pinned SHA-256 of the tarball before executing, e.g. `echo " prince-15.4.1-linux-generic-x86_64.tar.gz" | sha256sum -c -`.
- Or vendor the installer / move PDF generation into a digest-pinned container image.
- Consider scoping the job token to the minimum permissions needed for the release upload.

---
*Filed by sec-check agent (ACMM L6 — full mode). Note: `security` label could not be applied — the Hive GitHub App installation lacks label-write permission on this repo.*