feat: PDF-first runtime scaffold — docd, pdf-secure, pdf-viewer-demo, smoke validation

[Copilot]

Turns the declared PDF-first runtime boundary in the README into an executable scaffold with make validate and make smoke passing against zero external dependencies.

Services

• services/docd/src/derive.js — derive-lane placeholder (draft → derived); exits 0
• services/pdf-secure/src/sign-validate.js — sign/validate-lane placeholder; exits 0
• Both package.json files gain a "smoke": "node src/..." script and switch type to commonjs

Apps

• apps/pdf-viewer-demo/package.json — missing workspace manifest added
• apps/pdf-viewer-demo/src/smoke.js — viewer/demo smoke placeholder; exits 0

Makefile

Replaces the docker-only Makefile with targets that work without Docker:

make validate   # asserts all required dirs and scripts exist
make smoke      # invokes each placeholder script end-to-end

README

Rewrites the boundary section as a scanned table linking explicitly to sourceos-spec (contracts) and source-os (Linux realization). Adds commands, content-layout, and status tables.

Content layout

content/draft, content/derived, and content/reports were already present with .gitkeep placeholders — no changes needed.