ci(pdf): read rendered PDFs back in the toolchain job

[devin-ai-integration]

What and why

The pdf-toolchain job provisions every converter and diagram tool but not poppler-utils, and the integration tests read each rendered PDF back through pdftotext/pdfimages — so in CI every text and image assertion (headings, table cells, captions, KaTeX output, "no DOT/PlantUML source or fallback notice reached the page", the stylesheet-beside-the-output image) ended in t.Skip("pdftotext not installed") while the job reported green. OPENSYSML_REQUIRE_PDF_TOOLCHAIN=1 did not catch it because only the converters went through skipWithout.

Two changes:

• .github/workflows/pr.yml: the job's system-library step also installs poppler-utils.
• internal/doc/docpdf/integration_test.go: pdfText and pdfImages route an absent tool through skipWithout, exactly like a missing converter — a skip locally, a failure under the require variable. The per-test if text == "" { t.Skip(...) } / if text != "" && … guards were the only consumers of the empty-string sentinel and are gone, so the assertions are unconditional once a PDF was rendered.

Plus the changelog fragment and one sentence in the PDF testing skill naming poppler-utils as part of the local setup.

How it was verified

With the pinned toolchain (./scripts/download-doc-pdf-toolchain.sh) and poppler-utils installed:

• OPENSYSML_REQUIRE_PDF_TOOLCHAIN=1 go test -count=1 -v -run 'Installed|BesideTheOutput' ./internal/doc/docpdf — 24 subtests pass, the only skips are the seven prince ones (unprovisioned, exempt by design).
• Same command with a PATH that hides pdftotext/pdfimages: without the require variable, weasyprint/pandoc subtests skip with pdftotext not installed; with it, they fail with OPENSYSML_REQUIRE_PDF_TOOLCHAIN=1 but pdftotext not installed — the failure this PR wants CI to be able to produce.
• go test -count=1 ./internal/doc/... (no toolchain in the environment) passes: the fake-tool tests are unaffected.
• go build ./..., go vet, gofmt -l . empty, python3 scripts/changelog.py check, python3 scripts/check-doc-ids.py.

The pdf-toolchain job on this PR is the end-to-end check: its log should now show the text assertions running (no pdftotext not installed lines).

Checklist

• make test and make lint pass locally
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved (compliance rows need nothing: the census is counted at docs build)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.