CL-6499: Gotenberg-backed Markdown-to-PDF rendering

[TheGreatAxios]

Summary

• Adds @corbits/gotenberg-render, a domain package that renders a Markdown Library artifact to PDF through an operator-configured Gotenberg server, and hands the resulting bytes to a caller-supplied sink to persist as a new artifact.
• resolveGotenbergConfig(env) reads GOTENBERG_URL (arktype-validated at the boundary) and returns null when unset — the render capability is then simply absent, never a startup error and never a no-op button.
• renderMarkdownToPdf is a thin client over Gotenberg's Chromium convert/markdown route.
• renderMarkdownArtifactToPdf orchestrates render + persist and reports any failure through @corbits/error-sink, returning a plain-language message ("Couldn't build the PDF. Try again shortly.") plus a refId — never a raw HTTP status.
• Source/sink are injected ports (not a hardcoded artifact store), matching how @corbits/artifacts-hub's own routes inject their store.

What's still missing (see package README)

Rendering works end to end against any Markdown + a running Gotenberg server. Two gaps remain before a real Scout-produced brief renders with no glue code:

• The workflow-run artifact surface has POST / and GET /recent but no GET /:id to read an artifact's content back.
• That surface stores content as a size-capped JSON string with no binary path; the only route accepting arbitrary bytes today is the tenant-session-authenticated Library upload, not a workflow run's sidecar token.

Out of scope per the lane brief: workflows/diligence-brief/ (research orchestration) and any UI wiring — this PR is rendering only.

Test plan

• bun test in packages/gotenberg-render — 9/9 passing (markdown artifact renders to PDF bytes; unconfigured endpoint returns null rather than erroring; a malformed GOTENBERG_URL throws; a Gotenberg network/HTTP failure surfaces the friendly message + reports through @corbits/error-sink)
• bun run typecheck in packages/gotenberg-render
• Repo-root bun run check (typecheck/lint/test), check:packages, check:licenses — skipped: the owner's machine is out of memory and asked that only package-scoped bun test/typecheck run this session. LICENSE/package.json/exports shape was matched by hand against packages/error-sink.

https://github.com/corbitsdev/workbench/pull/new/cl-6499-gotenberg