fix(pdf): make pdfjs survive bundling + real-PDF font fidelity (live smoke)

Live dispatch smoke against the Turbopack dev server (master's ask,
2026-09-19) caught two things unit tests cannot - they run unbundled:

- Bundling pdfjs-dist broke its node fake-worker: the chunk-relative
  pdf.worker.mjs import 404s inside .next/dev/server/chunks. Fix:
  serverExternalPackages + tracing includes for legacy/ + standard_fonts/
  (next.config.ts - a clearly-marked seam, same precedent as bcdcd51; the
  standalone output now ships the worker and font files, verified).
- Real-world PDFs warned about missing standardFontDataUrl (non-embedded
  standard fonts silently fall back) and flooded the log with JBIG2
  warnings on scanned files. Fix: standardFontsDir() + verbosity 0 in
  both the node ops and the headless canvas shim.

Verified live end-to-end on GEB (802pp, text layer): teacher dispatch,
12-step read with vision renders, brief with accurate page citations,
wake turn folding the resolution (Chapter IX, pp. 268-270) into the
lesson. Scanned/DRM Polya correctly refuses to fabricate citations.

src/agent/subagents/pdf-ops.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 /**
  * PDF plumbing for the pdf-reader sub-agent — sources v0 (2026-09): Node
@@ -42,12 +43,22 @@ async function loadPdfjs() {
 	return pdfjs;
 }
 
+/** Standard-font data dir (live-smoke finding 2026-09-19: without it pdfjs
+ *  warns and falls back on non-embedded standard fonts — Helvetica, Times…).
+ *  The node side takes a plain filesystem path. Resolved from this module's
+ *  location, the headless.ts PATHS_nodeModules idiom. */
+export function standardFontsDir(): string {
+	return path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "node_modules", "pdfjs-dist", "standard_fonts") + path.sep;
+}
+
 async function openDocument(filePath: string) {
 	const pdfjs = await loadPdfjs();
 	const data = new Uint8Array(await fs.readFile(filePath));
 	// The legacy build in plain node runs on a main-thread fake worker (no
 	// workerSrc needed); teardown is the loading task's destroy().
-	const task = pdfjs.getDocument({ data });
+	// verbosity 0 = errors only — scanned PDFs (JBIG2 XObjects) otherwise
+	// flood the log with per-page warnings (live-smoke finding 2026-09-19).
+	const task = pdfjs.getDocument({ data, standardFontDataUrl: standardFontsDir(), verbosity: 0 });
 	return { doc: await task.promise, task };
 }