Paper artifact runtime

Internal deterministic runtime for meta-paper-write. It accepts one JSON
object on standard input with an operation field and performs exactly one of
these operations inside the orchestrator-owned workspace:

• persist_sections
• assemble_manuscript_tex
• materialize_manuscript
• apply_length_expansion
• citation_map
• compile_pdf

The runtime validates the runtime-owned MetaSkill run identifier, rejects
symlinked artifact roots and files, and keeps every artifact under
paper/<meta_run_id>/. PDF compilation invokes the managed xelatex and
bibtex executables with a platform-neutral argument vector, disables TeX
shell escape, applies paranoid Kpathsea file access, and verifies the real PDF
page count and final LaTeX quality log before returning success markers. Length
repair accepts at most one bounded body-only fragment per stable repair id,
rejects commands that could alter document boundaries, citations, or external
inputs, and applies it idempotently inside the run-owned manuscript.