feat(pdf): extract standalone PDF ingest package (ESRC-WP-0001)

Bootstrap evidence-source from the citation-evidence src/source PDF slice.

- Headless core (src/pdf): ingest/extract/fingerprint, importing domain
  contracts from @citation-evidence/engine/shared (no local copies)
- Browser upload helpers isolated under src/browser behind a ./browser
  entry point, with an eslint boundary keeping the core browser-free
- pnpm/TS/vitest/eslint scaffold; 52 tests (contract + determinism)
- Fixtures resolved from the sibling citation-evidence checkout, not
  duplicated (real PII) — see docs/ADR-0002; suites skip when absent
- Boundary + fixture decisions recorded as docs/ADR-0001 / ADR-0002
- README/SCOPE rewritten; capability.infotech.pdf-evidence-ingest
  registered, NO_CAPABILITIES removed
- Follow-on workplans ESRC-WP-0002..0004 queued; ESRC-WP-0001 finished

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/ESRC-WP-0004-citation-recovery.md

@@ -0,0 +1,47 @@
+---
+id: ESRC-WP-0004
+type: workplan
+title: "Local citation recovery and external source discovery hooks"
+domain: infotech
+repo: evidence-source
+status: proposed
+owner: codex
+topic_slug: citation_evidence_mvp
+created: "2026-07-08"
+updated: "2026-07-08"
+spec_refs:
+  - INTENT.md
+  - README.md
+---
+
+# ESRC-WP-0004 — Citation recovery and source discovery hooks
+
+`evidence-source`'s original intent includes recovering citations when a stored
+selector goes stale and discovering the external source a document was drawn
+from. This is the largest deferred strand and depends on the anchoring layer's
+selector model.
+
+## Open questions
+
+- What is the recovery contract — does this repo *detect* stale selectors, or
+  only provide the re-ingest/re-fingerprint primitives the anchor layer calls?
+- Where does external source discovery (URL/DOI resolution) belong relative to
+  `citation-engine` and the umbrella?
+
+## Sketch
+
+```task
+id: ESRC-WP-0004-T01
+status: todo
+priority: low
+```
+Design the recovery boundary with the anchor layer: define what
+`evidence-source` owns vs. what stays in anchoring.
+
+```task
+id: ESRC-WP-0004-T02
+status: todo
+priority: low
+```
+Prototype re-ingest/re-fingerprint recovery primitives and a discovery hook
+interface (no network coupling baked into the core).