fix(deps): move PDF parsing to lopdf 0.42, clearing RUSTSEC-2026-0187

[us]

Lands four of the five open dependabot bumps as one change, because pdf-inspector
and lopdf have to move together.

Why now

.github/dependabot.yml carried a lopdf ignore waiting on exactly this:
pdf-inspector 1.17.0 is the first published release built on lopdf 0.42, which
carries the RUSTSEC-2026-0187 fix. lopdf 0.41 and earlier parse nested PDF arrays
with unbounded recursion, so a 21,095-byte file whose Catalog holds a 10,380-deep
array aborts the process with SIGABRT. A stack-overflow abort does not unwind, so
the catch_unwind in crw_extract::pdf::convert never covered it.

Same proof-of-concept file, both versions:

lopdf 0.41: fatal runtime error: stack overflow, aborting   exit 134
lopdf 0.42: OK loaded, 2 objects                            exit 0

Also exercised through the built binary against a local server serving that file:
the scrape returns cleanly instead of killing the process. deeply_nested_objects_do_not_abort
in crates/crw-extract/tests/pdf_tests.rs keeps it that way.

Why the 0.1.6 pin can come off

The pin was set because 0.1.7 gutted pages 6 to 11 of arXiv 1412.6980. Re-measured
over 29 real PDFs (ML papers, IRS forms and instructions, RFC 2616, a 10-K, the ECB
annual report, the UN SDG report, NIST CSF, the 756-page ISO PDF 32000-1 spec),
scoring word recall against pdftotext as ground truth:

	0.1.6	1.17.0
weighted word recall (687,810 ground-truth words)	97.72%	98.15%
documents improved		23 of 29
worst regression		-0.37 points
arXiv 1412.6980, per page	98.3-100%	97.2-100%

The raw character count falls 0.78%, which is not a loss: 1.17.0 rejoins hyphenated
line breaks and stops duplicating table rows. Both confirmed against poppler, e.g.
immediate parent of this one appears twice in the PDF spec, 0.1.6 emitted it four
times and 1.17.0 emits it twice. 1.17.0 also stops shredding small-caps runs, so the
Adam paper's title reads as a title instead of DAM : A M ETHOD FOR S TOCHASTIC.

Feature surface

pdf-inspector 1.15 added OCR through PDFium and ONNX Runtime, but default = []
still holds, so none of ocr, render-pdfium or model-download is enabled and no
native library enters the build. The only new non-optional dependency is
include_dir 0.7.

Contents

• pdf-inspector 0.1.6 -> 1.17.0 (closes chore(deps): bump pdf-inspector from 0.1.6 to 1.17.0 #473), lopdf 0.41 -> 0.42, one copy in the tree
• base64 0.22 -> 0.23 (closes chore(deps): bump base64 from 0.22.1 to 0.23.1 #471), jsonschema 0.50.0 -> 0.50.1 (closes chore(deps): bump jsonschema from 0.50.0 to 0.50.1 in the cargo-minor-patch group #470)
• drop the lopdf and pdf-inspector 0.1.7 dependabot ignores, both satisfied
• regression test for the nested-object abort

Not included: #472 (yaml-rust2 0.11 -> 0.12). The config crate pins 0.11 and it is
a dev-dependency used to parse docker-compose.yml in one test, so the bump only
adds a second yaml-rust2 and a second hashlink to the tree.

Deploy note

Merging this rebuilds the prod engine within the hour through the opencore.pin
bump, so the PDF path changes in production on merge, not at the next release.
No API shape, no config key and no default changes.