mopac-pdf v0: markdown to beautiful PDFs via digest-pinned typst

Go CLI that turns the markdown currency of this stack (Redmine notes,
Discourse posts, briefing output) into typeset PDFs: two embedded typst
templates (report with title page/TOC/headers, dense brief), front-matter
(title/subtitle/author/date/classification/template), GFM tables, and
bar charts rendered in pure Go (go-chart) from fenced chart data blocks.
Engine is a prebuilt typst 0.15.1 container pinned by digest and run
--network none; PDF bytes to stdout or -o. Exit codes 0/1/2.

All dev in docker (dev.sh/Makefile); unit tests + golden typst fixtures
plus a host-side smoke against the real engine container.

Generated with Crush

Assisted-by: Crush:glm-5.2

dev.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+# mopac-pdf dev wrapper. EVERY compile/vet/test path routes through the
+# digest-pinned Docker builder (ALL dev work in Docker — the host runs
+# containers, never toolchains). The runtime engine (typst) is a separate
+# digest-pinned image driven by the CLI itself; see internal/engine.
+#
+# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
+#
+#   build    compile ./cmd/mopac-pdf into bin/mopac-pdf
+#   vet      go vet ./...
+#   test     go test ./... (engine tests use a stub docker; the real typst
+#            container is exercised by smoke)
+#   check    build + vet + test (the pre-push gate)
+#   smoke    end-to-end: builds, compiles the sample fixtures through the
+#            REAL digest-pinned typst container, checks PDF magic + page
+#            counts, writes samples to out/
+#   shell    interactive sh inside the builder
+set -e
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (same as the mopac-keyproxy/bitwarden-go builders)
+
+run() {
+    docker run --rm -v "$PWD:/h" -w /h \
+        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+        "$IMAGE" "$@"
+}
+
+cmd=${1:-check}
+shift || true
+
+case "$cmd" in
+build)
+    run go build -mod=vendor -o bin/mopac-pdf ./cmd/mopac-pdf
+    ;;
+vet)
+    run go vet -mod=vendor ./...
+    ;;
+test)
+    run go test -mod=vendor "$@" ./...
+    ;;
+check)
+    run sh -c 'go build -mod=vendor -o bin/mopac-pdf ./cmd/mopac-pdf && go vet -mod=vendor ./... && go test -mod=vendor ./...'
+    ;;
+smoke)
+    ./smoke/smoke.sh
+    ;;
+shell)
+    run sh
+    ;;
+*)
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
+    exit 1
+    ;;
+esac