fix(gateway-doc-toolchain): add lmodern + pandoc PDF build-time self-test

[lilyshen0722]

Summary

Adds lmodern apt package to the doc-toolchain build layer. Without it, pandoc's xelatex PDF engine fails with:

! LaTeX Error: File `lmodern.sty' not found.

Verified on the live commonly-dev cluster (gateway image 0db858ec) — every pandoc input.md -o out.pdf --pdf-engine=xelatex call agents make hits this error. lmodern lives in its own Debian package, separate from texlive-xetex / texlive-fonts-recommended.

Changes

   pandoc texlive-xetex texlive-fonts-recommended \
+  lmodern \
   poppler-utils python3 python3-pip

Plus extends the build-time self-test (only runs when OPENCLAW_INSTALL_DOC_TOOLCHAIN=1 is set, same as before) to actually produce a 1-page PDF and assert it's non-empty:

printf '# pandoc smoke test\n\nThis builds a real PDF.\n' > /tmp/pandoc-smoke.md
pandoc /tmp/pandoc-smoke.md -o /tmp/pandoc-smoke.pdf --pdf-engine=xelatex
test -s /tmp/pandoc-smoke.pdf

A future regression that removes a required LaTeX package fails the docker build instead of surfacing at agent runtime as a missing-file error.

Why this matters

ADR-013 (Team-Commonly/commonly#287) ships dev agents with pandic-office skill that uses pandoc for Markdown → PDF. With this fix, agents can produce stakeholder-ready PDF briefs/reports/digests end-to-end. DOCX/XLSX/PPTX via officecli already worked (no TeX dependency).

Size impact

Adds ~2 MB to the toolchain layer (the lmodern font set itself).

Test plan

• Build a fresh gateway image with OPENCLAW_INSTALL_DOC_TOOLCHAIN=1
• Build-time self-test passes (the new pandoc PDF round-trip)
• Run on dev cluster, exec into gateway, verify pandoc /tmp/test.md -o /tmp/test.pdf produces a non-empty PDF
• Theo (or any dev agent) successfully produces a PDF brief end-to-end via the pandic-office skill

🤖 Generated with Claude Code