test: install qpdf so the independent oracle actually runs

.github/workflows/ci.yml

@@ -26,10 +26,18 @@ jobs:
           check-latest: true
           cache: true
 
+      # qpdf is a second, independent oracle: it reads back what we wrote and
+      # says whether it is well formed. Without it TestObjectStreamsQPDF skips
+      # and the lane is green over the one test a stranger performs.
+      - name: qpdf, the independent oracle for what we write
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq qpdf
+
       - name: go vet
         run: go vet ./...
 
       - name: Test with coverage
+        env:
+          PDFKIT_REQUIRE_QPDF: "1"
         run: go test -covermode=set -coverprofile=coverage.out ./...
 
       - name: Assert exact 100% statement coverage

objstm_test.go

@@ -343,6 +343,12 @@ func TestObjectStreamsRichDocument(t *testing.T) {
 func TestObjectStreamsQPDF(t *testing.T) {
 	qpdf, err := exec.LookPath("qpdf")
 	if err != nil {
+		// A skipped oracle reads exactly like a passing one. The lane that
+		// installs qpdf sets this, so its absence there is a broken lane and
+		// not a reason to go quietly green.
+		if os.Getenv("PDFKIT_REQUIRE_QPDF") != "" {
+			t.Fatalf("PDFKIT_REQUIRE_QPDF is set but qpdf is not installed: %v", err)
+		}
 		t.Skip("qpdf not installed")
 	}
 	dir := t.TempDir()