Harden URP streaming, telemetry, CI, and releases

[gmile]

Summary

• harden URP stream lifetimes, cleanup, error propagation, pool checkout handling, and per-connection protocol caches
• emit complete telemetry spans with start, stop, and exception events
• make LibreOffice integration tests explicit and use the Nix flake as CI/release toolchain source of truth
• correct the soffice concurrency guidance and remove the Bridge/Stream dependency cycle
• harden release validation, GitHub Actions pinning, benchmark containers, and benchmark result verification
• refresh performance measurements on Elixir 1.20.2 / OTP 29.0.3

Why

The audit found correctness issues around streamed input resource lifetime, unbounded enumerable producers, partial-success output handling, sticky connection errors, and process-local URP caches leaking across pooled connections. CI also duplicated the BEAM toolchain outside the flake, unit tests probed ambient LibreOffice state, and the release workflow could publish without running the full validation suite.

The README claim that concurrent operations on a single soffice process are categorically unsafe was also too broad. LibreOffice accepts multiple connections, but they share process-wide state and generally provide little throughput improvement; separate processes remain the predictable isolation model.

Impact

This is intended as a backward-compatible 0.10.2 hardening release. Existing stop telemetry remains, with additive start/exception events and retry measurements. Non-bang APIs now return controlled errors for pool checkout and sink failures instead of raising or reporting partial success.

Validation

• 93 tests passed against LibreOffice 26.2.4.2
• Dialyzer: 0 errors
• formatting, docs warnings, xref cycle check, Hex audit, and Nix flake validation passed
• benchmark Docker image built and health-checked
• benchmark smoke conversions validated as PDFs

Benchmarks (Apple M3 Max)

Fixture	Debian URP	Alpine URP	Gotenberg
2.6 MB	0.76 s	1.14 s	1.18 s
15.5 MB	5.16 s	6.98 s	7.30 s

The Debian URP results are within normal variance of the previous 0.73 s / 5.10 s measurements.