test(make-pdf)+feat(diagram): review-wave test pins + skill transport hardening

Tests: indented-fence byte-for-byte replay + no-extraction-in-lists,
drive-letter local-path routing, $-pattern slot immunity, base64 source
round-trip ('A --> B' exact), existing-style merge preservation, DOCX
rasterize-failure surfaces source, srcSha256 + font-stack drift guards,
landscape veto asserted as some-portrait/no-landscape (layout-order-proof),
judge rubric cap lowered to 5 so it actually fails, vacuous error-shape test
removed honestly, tmpdir cleanup.

/diagram skill: base64 transport (template literals corrupted backticks/${
in sources), content-addressed staging with hash verification, and --tab-id
pinned on every browse call so a concurrent /qa session can't be clobbered.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

make-pdf/test/e2e/landscape-gate.test.ts

@@ -91,15 +91,17 @@ describe("landscape promotion gate", () => {
       expect(portrait.length).toBeGreaterThanOrEqual(2);
       expect(isLandscape(boxes[0])).toBe(false);
 
-      // The veto'd diagram rendered (its labels exist) on a PORTRAIT page.
+      // The veto'd diagram rendered on SOME portrait page and NO landscape
+      // page — the actual invariant. (Asserting a specific page index breaks
+      // spuriously when font metrics shift pagination.)
       const pdftotext = resolvePopplerTool("pdftotext")!;
-      const lastPortrait = portrait[portrait.length - 1];
-      const vetoText = execFileSync(
-        pdftotext,
-        ["-f", String(lastPortrait.page), "-l", String(lastPortrait.page), outputPdf, "-"],
-        { encoding: "utf8", timeout: CHILD_TIMEOUT_MS },
-      );
-      expect(vetoText).toContain("vetoalpha");
+      const pageText = (page: number) =>
+        execFileSync(pdftotext, ["-f", String(page), "-l", String(page), outputPdf, "-"], {
+          encoding: "utf8",
+          timeout: CHILD_TIMEOUT_MS,
+        });
+      expect(portrait.some((b) => pageText(b.page).includes("vetoalpha"))).toBe(true);
+      expect(landscape.some((b) => pageText(b.page).includes("vetoalpha"))).toBe(false);
     } finally {
       try { fs.rmSync(workDir, { recursive: true, force: true }); } catch { /* ignore */ }
     }