fix: harden resume generation and anonymize public examples

[willstodev]

Arete's existing tests passed while missing executable Markdown front matter, shell-interpolated compiler paths, destructive template initialization, and incorrect PDF page validation. This change repairs those boundaries, preserves candidate facts during parsing, and verifies real resume PDFs in CI.

• Parse YAML-only metadata; retain empty field positions, original source lines, complete wrapped summaries, valid dates, and STAR-note boundaries.
• Run the npm-managed Tectonic binary without a shell in isolated temporary directories, discover working fallback paths, and parse PDF page trees before publishing output.
• Protect candidate files from overwrite, sanitize public examples and template references, improve privacy ignores, restore 10pt body text, complete Portuguese labels, and warn about budget omissions.
• Update vulnerable dependencies within compatible ranges and add a sourced recruiting assessment in docs/RESUME_AUDIT.md. The general format aligns with published recruiting guidance; no claim is made that any employer uses or endorses this exact template. Anonymization covers repository content, not automatic anonymous exports or Git history.

Validation: frozen installation, formatting, lint, typecheck, 50 tests, coverage (96.38% lines; 85.65% branches), build, CLI validation, and full dependency audit passed. Lint retains two existing parser/renderer complexity warnings. Actual concurrent English/Portuguese one-page A4 PDFs pass Poppler extraction checks; real oversized content is rejected. The English PDF was visually reviewed at 10pt. System TeX fallback boundaries are fixture-tested; the actual local PDF smoke uses bundled Tectonic.