fix(CodeQL#12-15): use real_out_dir for makedirs and pdf_path in dossier_generator -- original output_dir was not used post-validation

fix(H-07,CodeQL#12-17): use file-anchored absolute paths for path traversal guards in dossier_generator and export -- relative realpath() was CWD-dependent

fix(NEW-A3 part1): replace em-dashes/smart-quotes in 56+ Python files -- CI requires pure ASCII source

fix(security): path traversal guards on file output paths — CodeQL alerts 12-16

feat(ai): complete — PDF dossier generator with integrity hash