fix(deps): update module github.com/go-pdfkit/reader to v0.9.0

[tannevaled]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-pdfkit/reader	v0.7.0 → v0.9.0

---

Release Notes

go-pdfkit/reader (github.com/go-pdfkit/reader)

v0.9.0

Compare Source

v0.8.0: — an Operation says which bytes of the stream it is

Compare Source

Operation gains Start and End: the byte range of the operation in the
stream it was scanned from — Start at its first operand (or at the operator
when it has none), End just past the operator.

⛔ They are here so a content stream can be edited in place

A tool that wants to put something before every BT has two honest ways to
find one:

• re-serialise the whole stream, which risks changing what an inline
  image's bytes mean;
• know where the operator was — and this scanner is the only thing that
  does.

BT appears inside strings, inside names, and inside an inline image's data,
and a byte search cannot tell those from an operator. The test pins the
discriminator:

(BT in a string) Tj  BT /F1 12 Tf ET
 ^ byte search: 1                      ← inside somebody's text
                     ^ the scan: 20     ← the operator

A tool splicing at index 1 corrupts the string.

Two details that are easy to get wrong

• End is the lexer's position, not the operator's start plus its length.
  An inline image's operator token is BI and its operation runs to the EI
  three keywords later, so measuring from the operator would put the end in
  the middle of the image's data — where a splice corrupts the image instead
  of the stream around it. Asserted;
• Start is the first operand's position, so splicing before an operation
  does not land between its operands and its operator. 1 0 0 RG starts at
  the 1, not at the RG.

The ranges of a stream are asserted ordered and disjoint, which is what
lets a caller splice at several of them in one pass, and a stream with rubbish
in it keeps honest ranges around what the scan stepped over.

Why in reader rather than in the caller

Three packages already scan content streams through this one scanner —
extract, render and latex — so the primitive is shared already; what was
missing was the one fact only the scan has. The first consumer is
go-pdfkit/ops, for a verb that recolours text without touching anything else.

Checks

100 % statement coverage, go vet and gofmt clean. Two mutations caught: the
range reduced to the operator alone, and the first-operand mark overwritten by
each later operand.

🤖 Generated with Claude Code

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.