feat(pdf): extract standalone PDF ingest package (ESRC-WP-0001)

Bootstrap evidence-source from the citation-evidence src/source PDF slice.

- Headless core (src/pdf): ingest/extract/fingerprint, importing domain
  contracts from @citation-evidence/engine/shared (no local copies)
- Browser upload helpers isolated under src/browser behind a ./browser
  entry point, with an eslint boundary keeping the core browser-free
- pnpm/TS/vitest/eslint scaffold; 52 tests (contract + determinism)
- Fixtures resolved from the sibling citation-evidence checkout, not
  duplicated (real PII) — see docs/ADR-0002; suites skip when absent
- Boundary + fixture decisions recorded as docs/ADR-0001 / ADR-0002
- README/SCOPE rewritten; capability.infotech.pdf-evidence-ingest
  registered, NO_CAPABILITIES removed
- Follow-on workplans ESRC-WP-0002..0004 queued; ESRC-WP-0001 finished

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

eslint.config.js

@@ -0,0 +1,58 @@
+// ESLint flat config for evidence-source.
+//
+// Enforces the one boundary that matters in this repo: the browser upload
+// surface (`src/browser/**`) may depend on the headless core (`src/pdf/**`),
+// but the headless core must never import from `src/browser/**`. That keeps
+// `src/pdf/` runtime-agnostic (no `URL.createObjectURL`, no `Blob` upload
+// path) so it loads cleanly in Node and browsers alike.
+
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+import importPlugin from "eslint-plugin-import";
+import globals from "globals";
+
+export default tseslint.config(
+  {
+    ignores: ["dist/", "node_modules/", "coverage/", "**/*.d.ts"],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ["src/**/*.ts", "tests/**/*.ts"],
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: "module",
+      globals: { ...globals.node },
+    },
+    plugins: {
+      import: importPlugin,
+    },
+    settings: {
+      "import/resolver": {
+        typescript: { project: "./tsconfig.json" },
+      },
+    },
+    rules: {
+      "no-restricted-imports": [
+        "error",
+        {
+          patterns: [
+            {
+              group: ["**/browser/**", "../browser/*", "./browser/*"],
+              message:
+                "The headless core (src/pdf) must not depend on browser helpers (src/browser).",
+            },
+          ],
+        },
+      ],
+    },
+  },
+  {
+    // Browser helpers are allowed to reach into the headless core; relax the
+    // guard for tests, which import from anywhere.
+    files: ["src/browser/**/*.ts", "tests/**/*.ts", "src/index.ts"],
+    rules: {
+      "no-restricted-imports": "off",
+    },
+  },
+);