ci(nightly): repair five job classes broken by the #649 QA hardening (#695)

Nightly has been red since 07-28; per-PR CI and main are green. Two investigations traced all five failing classes to #649: extended-matrix required AI bundles it never installs (removed), nightly SYSTEM_DEPS drifted from ci.yml (added libreoffice + a doc-binaries composite for pandoc/pdfcpu), the generated-case classifier only skipped ffmpeg (widened to pdfcpu/soffice/pandoc + excluded repo-audit specs from the lean docker image), a settings spec capped loginAttemptLimit and 429-cascaded the serial bucket (restore via API), and type-to-search refused keystrokes under a route announcer's programmatic focus (guard added). A nightly dispatch on the branch confirmed all five classes green.

.github/actions/doc-binaries/action.yml

@@ -0,0 +1,21 @@
+name: Install doc-engine binaries
+description: >-
+  Install the curl-fetched doc-engine binaries (pandoc + pdfcpu) that the
+  document tools need. LibreOffice comes from apt separately. Versions match
+  ci.yml and docker/Dockerfile; keep the three in sync.
+runs:
+  using: composite
+  steps:
+    - name: Install Pandoc 3.10 (sandboxed DOCX/EPUB)
+      shell: bash
+      run: |
+        curl -fsSL https://github.com/jgm/pandoc/releases/download/3.10/pandoc-3.10-1-amd64.deb -o /tmp/pandoc.deb
+        sudo apt-get install -y --no-install-recommends /tmp/pandoc.deb
+        pandoc --version
+    - name: Install pdfcpu (doc-engine PDF layout binary; matches docker/Dockerfile v0.13.0)
+      shell: bash
+      run: |
+        curl -fsSL https://github.com/pdfcpu/pdfcpu/releases/download/v0.13.0/pdfcpu_0.13.0_Linux_x86_64.tar.xz -o /tmp/pdfcpu.tar.xz
+        tar -xJf /tmp/pdfcpu.tar.xz -C /tmp
+        sudo install "$(find /tmp -type f -name pdfcpu | head -1)" /usr/local/bin/pdfcpu
+        pdfcpu version

.github/workflows/nightly.yml

@@ -12,7 +12,7 @@ env:
   # Keep in sync with ci.yml's install step. tesseract-ocr + language packs are
   # required by the built-in Fast OCR tier: without them the OCR integration
   # tests throw "spawn tesseract ENOENT" and fail the coverage/matrix jobs.
-  SYSTEM_DEPS: libheif-examples libheif-plugin-x265 libheif-plugin-libde265 libimage-exiftool-perl libraw-bin imagemagick ghostscript libjxl-tools libopenjp2-tools ffmpeg qpdf tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra tesseract-ocr-spa tesseract-ocr-chi-sim tesseract-ocr-jpn
+  SYSTEM_DEPS: libheif-examples libheif-plugin-x265 libheif-plugin-libde265 libimage-exiftool-perl libraw-bin imagemagick ghostscript libjxl-tools libopenjp2-tools ffmpeg qpdf libreoffice-calc libreoffice-impress libreoffice-writer tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra tesseract-ocr-spa tesseract-ocr-chi-sim tesseract-ocr-jpn
   # See ci.yml: ryuk's Docker Hub pull is a recurring flake source; disable the reaper
   # (tests/global-setup.ts stops its containers explicitly; runners are ephemeral).
   TESTCONTAINERS_RYUK_DISABLED: "true"
@@ -366,6 +366,7 @@ jobs:
             sudo sed -i 's/<policy domain="coder" rights="none" pattern="EPS"/<policy domain="coder" rights="read" pattern="EPS"/' "$POLICY_FILE"
             sudo sed -i 's/<policy domain="coder" rights="none" pattern="PS"/<policy domain="coder" rights="read" pattern="PS"/' "$POLICY_FILE"
           fi
+      - uses: ./.github/actions/doc-binaries
       - uses: ./.github/actions/setup
       - name: Pre-pull testcontainer images (retry transient Docker Hub errors)
         run: |
@@ -384,7 +385,9 @@ jobs:
           FULL_MATRIX: "1"
           FUZZ: "1"
           FUZZ_RUNS: "50"
-          REQUIRE_AI_FEATURES: "1"
+          # This lane installs no AI bundles, so it must not run the strict
+          # required-AI contract (that 501s every installed-contract case). The
+          # strict contract runs on the release-QA fleet, which has bundles.
           # Full-matrix tests iterate every format x tool; with 4 forks the heavy
           # media conversions starve and hit the 30s default. Fewer forks (more
           # CPU each) plus a generous timeout keeps them from flaking.
@@ -499,6 +502,7 @@ jobs:
             sudo sed -i 's/<policy domain="coder" rights="none" pattern="EPS"/<policy domain="coder" rights="read" pattern="EPS"/' "$POLICY_FILE"
             sudo sed -i 's/<policy domain="coder" rights="none" pattern="PS"/<policy domain="coder" rights="read" pattern="PS"/' "$POLICY_FILE"
           fi
+      - uses: ./.github/actions/doc-binaries
       - uses: ./.github/actions/setup
       - name: Run tests with coverage
         run: pnpm vitest run --coverage tests/unit/ tests/integration/