fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

JobTrackerApi.Tests/PdfBrowserStub/PdfBrowserStub.csproj

@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net9.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+</Project>

JobTrackerApi.Tests/PdfBrowserStub/Program.cs

@@ -0,0 +1,25 @@
+// Inert process fixture: no browser, HTML execution, network, or production data.
+var root = Environment.GetEnvironmentVariable("PDF_STUB_ROOT")!;
+var output = args.Single(arg => arg.StartsWith("--print-to-pdf=", StringComparison.Ordinal))[15..];
+var input = new Uri(args[^1]).LocalPath;
+var mode = await File.ReadAllTextAsync(File.Exists(Path.Combine(root, "mode")) ? Path.Combine(root, "mode") : input);
+await File.WriteAllTextAsync(Path.Combine(root, $"{Environment.ProcessId}.started"), input);
+if (!mode.Contains("no-output")) await File.WriteAllTextAsync(output, "%PDF-partial");
+if (mode.Contains("hold"))
+{
+    // Bound the fixture itself if its parent test runner is forcibly terminated.
+    var deadline = DateTime.UtcNow.AddSeconds(30);
+    while (!File.Exists(Path.Combine(root, "release")))
+    {
+        if (DateTime.UtcNow >= deadline) return 3;
+        await Task.Delay(20);
+    }
+}
+if (mode.Contains("logs"))
+{
+    await Console.Out.WriteAsync(new string('o', 100_000));
+    await Console.Error.WriteAsync(new string('e', 100_000));
+}
+if (mode.Contains("fail")) return 2;
+if (!mode.Contains("no-output")) await File.WriteAllTextAsync(output, "%PDF-synthetic-success");
+return 0;