RG-3 — Migrate PDF import, extraction and export pipeline

[daniele21]

Parent plan: docs/workstreams/ombra-to-redactguard-migration.md

Goal

Move the complete PDF boundary into RedactGuard independently from the LLM integration.

Scope

• Storage Access Framework import
• bounded extraction/segmentation
• isolated parser lifecycle
• encrypted/malformed/image-only/unsupported outcomes
• cancellation and deterministic cleanup
• new-PDF export
• independent output verification
• synthetic PDF fixture generator/provenance

Parallelism

Starts immediately. It does not depend on the Harness SDK and can proceed in parallel with RG-2, RG-4, RG-5 and HSDK-1.

Exit criteria

Import -> extract -> deterministic export fixture tests pass without an LLM; accepted surfaces are absent, ignored surfaces remain, and resources are cleaned on success/failure/cancel.