Security: adm-zip bumped past CVE-2026-39244 (GHSA-xpcp-8h2w-3j85), which was
reachable from 'cascade convert' via the C/CDA converter's entry.getData() call.
Pinned by tests/adm-zip-declared-size.test.ts, which asserts on allocation
rather than rejection because the vulnerable version throws identically.

Removed: unused pdfjs-dist (carried a HIGH arbitrary-JS-execution advisory into
every install) and the now-redundant @types/adm-zip.