Deliver resume PDFs through the API and MCP

[sarthakagrawal927]

Agents can request format: "pdf" with a job URL and an owned master resume. REST returns a named PDF artifact in the existing JSON contract; MCP returns an embedded PDF resource with review, draft and change metadata. Markdown remains the default and HTML remains compatible.

Rendering precedes optional history persistence. Export failures return recoverable Markdown and a strict stateless render_pdf / rolepatch_render_resume_pdf retry path with no generation credit or history write. Existing authentication/revocation, tenant ownership, guest isolation, debit/refund rules and grounded source wording are preserved. Shared helpers remain behind the guarded REST/MCP facades.

Validation on the PR head:

• Required CI: full pnpm quality (including typecheck, coverage tests, code health and docs), plus pnpm cf:build; preview Worker build and Docs checks passed. 738 tests passed; the opt-in local PDF probe is skipped in CI.
• Local acceptance: the actual unchanged renderer produced a readable one-page PDF from the API fixture, 39,258 bytes. Contact, original experience/project bullets and education passed parsed-text assertions; the page PNG was visually inspected. Job extraction and AI output were mocked deterministic fixtures.
• Regressions cover guest/no persistence, cross-tenant denial, revoked access, strict retry input, PDF signature/size bounds, safe render failures, accounting/history ordering and stdio resource forwarding.

Opt-in local acceptance (inside an admitted fleet-workspace run):

env PUPPETEER_EXECUTABLE_PATH="$LOCAL_CHROME" \
  ROLEPATCH_PDF_EVIDENCE_DIR="$PDF_EVIDENCE_DIR" \
  corepack pnpm exec vitest run src/__tests__/resume-pdf-local.test.ts

The harness passes formatted HTML to the actual renderer in native Node to avoid Vitest's VM dynamic-import limitation. Configure the two environment variables for an existing local Chrome executable and evidence directory. Production browser-binding rendering and authenticated external-agent delivery remain unverified.

No deployment, frontend changes, new production dependencies, storage, migrations or auth audiences. Local managed verification ended with a periodic retired-workspace scan timeout; final checks/build are verified by CI. The published writer can be retired reversibly; local PDF evidence is preserved.