fix(make-pdf): guard every html-to-docx sizing path, keep non-ICNS formats

Review found three spellings that got past the regex guard and still hung
--to docx: a data-src decoy, a percent-encoded separator, and an unquoted
encoded colon. html-to-docx sizes images on three paths, and buildImage
URI-decodes the whole src first. The guard now mirrors all three, drops ICNS
(the only input its bundled image-size routes to the looping parser) instead
of allowlisting formats, so BMP and TIFF embed as before, and re-parses the
result with html-to-docx's own html-to-vdom to fail closed on anything the
regex misreads. The golden test tolerates CRLF checkouts on Windows.

Version Gate treats a failed file lookup as an empty list, so a partial
paginated result cannot decide the exemption.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/compare-pr-version.test.ts

@@ -73,6 +73,7 @@ describe('version gate: dependabot dependency-manifest exemption', () => {
     expect(step.env.GH_TOKEN).toBe('${{ secrets.GITHUB_TOKEN }}');
     expect(step.run).toContain('pulls/${{ github.event.pull_request.number }}/files');
     expect(step.run).toContain('--paginate');
+    expect(step.run).toContain('then PR_CHANGED_FILES=""; fi');
     expect(step.run).toContain('export PR_CHANGED_FILES');
     expect(workflow.jobs.check.permissions).toEqual({ contents: 'read', 'pull-requests': 'read' });
   });