Extract render-ats-pdf ↔ render-audit-report clone family (when a 3rd consumer lands)

[s-annam]

Context

Surfaced by the fallow pass in batch #400 (PR #421), deferred as non-blocking (reviewer-verified safe to defer).

src/lib/pdf/render-ats-pdf.ts and src/lib/pdf/render-audit-report.ts share a ~104-line clone family (page setup, pdf-lib font/layout scaffolding). They were left un-DRY on purpose in #343: the two renderers have genuinely diverged needs — the résumé PDF uses Poppins and a résumé layout, the audit report uses Helvetica and a report layout — so extracting a shared helper now would over-couple them.

Scope

Revisit once a third consumer or a concrete shared-layout need appears. Extract only the parts that are genuinely identical (e.g. a withPdfDoc / lazy-pdf-lib bootstrap + a page-cursor helper), leaving font/layout choices per-renderer. Do not force a shared template that both have to bend around.

Acceptance

• Duplicated scaffolding extracted to a shared helper; per-renderer font/layout stays local.
• fallow no longer flags the clone family.
• Roundtrip + audit-report render tests still green; no PII regression in the report path.

Refs #400, #343.

Lower priority than the other two #400 follow-ups — only act when a third consumer lands or the duplication actually causes a bug.

[s-annam]

Sequence after #438 (soft dependency, not a hard block)

Flagging this as in the blast radius of #438 (parse → export decomposition) without setting a hard blocked_by, since this issue is already dormant (only act when a 3rd consumer or a real shared-layout need lands).

The reason to hold: #438 Direction 2 is "split the render/layout model from the export/semantic model." If that direction is taken, the render scaffolding these two renderers share (render-ats-pdf.ts ↔ render-audit-report.ts) gets re-cut along a new seam — so DRYing them into a shared helper now risks extracting a shape #438 would then have to un-pick. Cheaper to let #438 decide the render-model boundary first, then extract whatever is genuinely common under that boundary.

No action needed until #438 records a direction (or a 3rd consumer forces the issue sooner). Refs #438.

[s-annam]

Closing as not needed: fallow dupes on current main no longer reports the ~104-line render-ats-pdf ↔ render-audit-report clone family — only a 7-line page-cursor clone remains — and the trigger (a third consumer) never arrived. load-pdf-lib.ts is already the shared bootstrap.