KNELPDF v1: pandoc 3.11 + texlive xetex/luatex on pinned bookworm

Fleet document-generation image. DejaVu/Noto fonts for unicode +
box-drawing. Remote push + cross-links queued (gitea incident #937).

Dockerfile

@@ -0,0 +1,30 @@
+# KNELPDF - TSYS Group fleet document-generation image.
+# pandoc + texlive (xetex/luatex) + DejaVu/Noto fonts (box-drawing + wide unicode).
+# Rebuild = bump the version pins, never float.
+
+FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
+
+ARG PANDOC_VERSION=3.11
+ARG PANDOC_DEB=pandoc-3.11-1-amd64.deb
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ca-certificates \
+      curl \
+      texlive-latex-base \
+      texlive-latex-recommended \
+      texlive-latex-extra \
+      texlive-xetex \
+      texlive-luatex \
+      texlive-fonts-recommended \
+      lmodern \
+      fonts-dejavu \
+      fonts-noto-core \
+ && curl -fsSL -o /tmp/pandoc.deb \
+      "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/${PANDOC_DEB}" \
+ && dpkg -i /tmp/pandoc.deb \
+ && rm -f /tmp/pandoc.deb \
+ && rm -rf /var/lib/apt/lists/*
+
+# Fleet rule: NO ENTRYPOINT - keeps `sh -c` composition working.
+CMD ["pandoc", "--version"]