fix: reject invalid PDF decoder input

[jmolz]

Summary

• Validate decoded PDF bytes before invoking PyPDFLoader
• Skip non-PDF librarian content such as HTML error pages without emitting page documents
• Keep the existing inline and librarian paths covered by the PDF decoder unit tests

Root cause

The PDF decoder checked librarian metadata MIME type, but still trusted the fetched content bytes. If a URL returned an HTML error page while the metadata path still identified the document as application/pdf, the decoder wrote those bytes to a .pdf temp file and handed them to the PDF loader.

Validation

• PYTHONPATH=/private/tmp/trustgraph-test-shim /private/tmp/trustgraph-949-venv/bin/pytest tests/unit/test_decoding/test_pdf_decoder.py -q
• /private/tmp/trustgraph-949-venv/bin/python -m py_compile trustgraph-flow/trustgraph/decoding/pdf/pdf_decoder.py tests/unit/test_decoding/test_pdf_decoder.py
• git diff --check

Fixes #949.

[github-actions]

Contributor License Agreement ✅

All contributors have signed the CLA. Thank you!

[cybermaggedon]

Tidy change, the additional test is appreciated

[jmolz]

Thanks, appreciate the review and merge. Glad the focused test helped keep the fix tight.