Implement PDF-first runtime slice after bootstrap PR #1

[mdheller]

Summary

Track the immediate follow-on work after PR #1 so sourceos-shell lands a real PDF-first runtime slice rather than stopping at bootstrap files.

Why

PR #1 establishes the runtime boundary and makes PDF-first sequencing explicit, but the actual runtime slice still needs to be added.

Scope

1. Derive lane

• services/docd/
• markdown -> derived artifact flow
• content draft / derived / report path alignment

2. Signing / validation lane

• services/pdf-secure/
• signing surface
• validation surface
• provenance sidecar/report outputs

3. Viewer lane

• apps/pdf-viewer-demo/ or equivalent
• artifact/ribbon/sidecar demo surface

4. Runtime bring-up

• compose/runtime files
• minimal local bring-up for docd + pdf-secure + viewer

Acceptance criteria

• services/docd/ exists
• services/pdf-secure/ exists
• viewer/demo surface exists
• runtime bring-up files exist
• scope remains PDF-first and defers broader shell surfaces

Related

• PR bootstrap: establish PDF-first runtime sequencing in sourceos-shell #1 — PDF-first bootstrap sequencing
• SociOS-Linux/source-os#93 — Linux realization tracker for the PDF lane
• SociOS-Linux/source-os#97 and #100 — Linux-side PDF stack/config checks