fix(F17): a PDF in a folder is not proof the package can be rebuilt

Build sweep run this session: 48 sources, 46 built, 2 failed. Infineon_AI_Engineer's
cover letter fails on font expansion (the font is not scalable); cv_template.tex
fails on unfilled placeholders, which is expected for the academic legacy path.
Overfull boxes: Microsoft ISE 25.33pt, Isovalent 0.88pt. All historical, all
left alone.

New: resume_builder/helpers/package_manifest.py records, per application
package, what a rebuild would ACTUALLY do - sources, class-file hashes, PDFs
present, and the reasons a rebuild would not reproduce the submitted document.
It is descriptive; nothing in it authorises rewriting a submitted file.

What it found across 21 packages:
- 17 are DATE-DEPENDENT. The cover letters use 	oday, so recompiling a
  historical package silently restamps it with today's date.
- 1 has an INCOMPLETE SOURCE DISTRIBUTION: output/NATO_AI_ENGINEER ships no
  resume.cls. It builds on this machine only because a copy exists elsewhere,
  and the shipped PDF hid that. Not repaired by copying the newest class in -
  the repo carries THREE different resume.cls variants (13/7/1 copies) and older
  macros differ, so that "fix" could silently change a historical document.
- 1 has no PDF at all, so nothing is reviewable without a build.

Classification: 7 application packages were in no reuse category. Added to
historical_revalidate, and the register now records the default explicitly -
anything unlisted is treated as revalidate-before-reuse. Being recent is not the
same as being verified; none of the seven was re-read for this.

Prevention rather than repair: 	oday removed from the cover-letter template so
new packages stop adding to the pile. A test now fails if it comes back, if the
manifest goes stale, or if a package is left unclassified.

Also: scan_document gained a template mode. A placeholder in a TEMPLATE is what
makes it a template; the defect is one surviving into a generated document.

37/37 tests pass; counter-proof still catches all 9.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qej5SBvhcbGXHwLqNWiskM

resume_builder/templates/coverletter_template.tex

@@ -27,7 +27,12 @@ Bern, Switzerland $\vert$
 \textit{City, country}
 
 \vspace{1em}
-\today
+% APPLICATION DATE -- replace with the literal date this letter is sent,
+% e.g. 11 September 2026. Do NOT use \today (review finding F17, 2026-09-11):
+% it makes the document date-dependent, so recompiling a historical letter silently
+% restamps it with the current date. 17 existing packages already carry that defect
+% and are deliberately left alone; new ones must not add to it.
+[GENERATE: application date, literal]
 
 \vspace{1em}
 \textbf{Application for \textit{exact role title}}