ci: hold every template's DOCX export to its corpus baseline on Linux

[DemchaAV]

Why

The DOCX fidelity corpus (#805) only runs when someone asks for it on a machine with LibreOffice. A change that sets a template's lines further from the page still merges green.

What changed

• docx-fidelity job in ci.yml ("DOCX Fidelity (LibreOffice)").
  • It installs LibreOffice Writer on a pinned ubuntu-24.04 image and installs the modules the corpus exports through.
  • It runs DocxFidelityCorpusTest with -Dgraphcompose.docxFidelity=libreoffice, and uploads what it measured with LibreOffice's log, kept for 7 days.
  • The image is pinned because the baseline is LibreOffice's setting of the text, and a new image's LibreOffice sets some lines a little apart.
• When it runs. On a pull request it runs when the new docx path filter matches: the engine, render-pdf (its font metrics), render-docx, templates, fonts, emoji, the corpus classes and baselines, the build files, and this workflow. Every push and dispatch runs it.
• It joins CI Gate's needs, so a failure fails the aggregate check (CiGateCoverageGuardTest holds that).
• libreoffice-linux.tsv / -lines.tsv: the Linux baseline, taken from this job's first run (LibreOffice 24.2.7), since LibreOffice on Linux sets text a little differently from Windows. It holds 4,156 of the corpus's 4,328 lines. As in the Windows baseline, OrangeOps and VioletGrid are set on 2 pages.
• The LibreOffice packages are cached a week at a time. The archive mirror served them at 50–95 kB/s: 17 to 27 minutes of a job whose corpus run takes 34 seconds.
• LibreOfficeConverter.build() resolves soffice to the real file before reading its versionrc. On Linux /usr/bin/soffice is a link, and the baseline's note read unknown.
• Docs. CONTRIBUTING.md says where each platform's baseline comes from. CHANGELOG.md has a Tests entry.

Verification

• The CI guards CiGateCoverageGuardTest, CiGateCoverageGuardParsingTest, CiGuardListGuardTest, CodeQlScopeGuardTest and BinaryCompatibilityGateGuardTest pass (24 tests).
• Full reactor gate: ./mvnw -B -ntp clean verify -pl :graph-compose-core,:graph-compose-render-pdf,:graph-compose-render-docx,:graph-compose-render-pptx,:graph-compose-templates,:graph-compose-testing,:graph-compose-qa,:graph-compose-coverage -am gives BUILD SUCCESS (qa 1809).
  • After install, examples run 93 green.
  • The knowledge checks pass.
• CI on this PR:
  • The first run failed on purpose: every document was "not in the baseline". Its measurements are the committed Linux baseline.
  • The second run passes against them (Tests run: 2, Failures: 0, 33s), with every other job and CI Gate green.

Lane: build/CI.