chore: align IaC with today's package installs + PDF comparison docs

DevOps sync (2026-05-21):
- Remove onlyoffice-desktopeditors from absent list (actively used)
- Add gnome-keyring, rbw to common role (secrets migration)
- Add perl-image-exiftool, icoutils, innoextract-git to dev-tools
  (Windows installer inspection)
- Create fonts role: Inter, Cascadia Code, Fira, Source Sans, TeX Gyre
- Create pdf role: zathura, zathura-pdf-mupdf, python-weasyprint
- Register new roles in workstation.yml

PDF comparison:
- Add pdf-comparison docs with Quarto/Typst/Pandoc outputs
- Add batch-pdf.sh script
- Update yazi-cheatsheet.md
- Ignore .quarto/ cache

scripts/batch-pdf.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# batch-pdf.sh - Convert all Markdown docs to professional PDFs via Pandoc + WeasyPrint
+# Usage: bash scripts/batch-pdf.sh [directory]
+# Default directory: docs/
+#
+# Pipeline:  pandoc md → HTML  →  weasyprint CSS → PDF
+# Requires:  pandoc, weasyprint, CSS file at docs/pdf-comparison/cheatsheet.css
+
+set -euo pipefail
+
+PROJ_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CSS_PATH="${PROJ_ROOT}/docs/pdf-comparison/cheatsheet.css"
+DOC_DIR="${1:-${PROJ_ROOT}/docs}"
+OUTPUT_DIR="${PROJ_ROOT}/docs/pdf-output"
+
+# Verify dependencies
+for cmd in pandoc weasyprint; do
+  command -v "$cmd" &>/dev/null || { echo "ERROR: $cmd not found. Install: sudo pacman -S $cmd"; exit 1; }
+done
+[[ -f "$CSS_PATH" ]] || { echo "ERROR: CSS not found at $CSS_PATH"; exit 1; }
+
+mkdir -p "${OUTPUT_DIR}"
+count=0
+errors=0
+tmpdir=$(mktemp -d)
+
+echo "=== Markdown → PDF Batch (Pandoc + WeasyPrint + CSS) ==="
+echo "CSS:      ${CSS_PATH}"
+echo "Input:    ${DOC_DIR}"
+echo "Output:   ${OUTPUT_DIR}"
+echo ""
+
+find "${DOC_DIR}" -name "*.md" -not -path "*/pdf-output/*" -not -path "*/.*" -not -name "hyprland-keybindings-no-meta.md" | sort | while read -r md_file; do
+  rel_path="${md_file#${DOC_DIR}/}"
+  rel_dir="$(dirname "${rel_path#${DOC_DIR#${PROJ_ROOT}/}/}")"
+  basename="$(basename "${md_file}" .md)"
+  title="${basename//-/ }"
+
+  out_subdir="${OUTPUT_DIR}"
+  if [[ "${rel_dir}" != "." && -n "${rel_dir}" ]]; then
+    out_subdir="${OUTPUT_DIR}/${rel_dir}"
+  fi
+  mkdir -p "${out_subdir}"
+
+  html_file="${tmpdir}/${basename}.html"
+  pdf_file="${out_subdir}/${basename}.pdf"
+
+  echo "  ${rel_path} ..."
+
+  pandoc "${md_file}" -t html5 --standalone \
+    --css "file://${CSS_PATH}" \
+    --metadata title="${title}" \
+    -o "${html_file}" 2>&1 || { echo "    PANDOC ERROR"; errors=$((errors+1)); continue; }
+
+  weasyprint "${html_file}" "${pdf_file}" 2>/dev/null || \
+    weasyprint "${html_file}" "${pdf_file}" 2>&1 | head -1
+
+  if [[ -f "${pdf_file}" ]]; then
+    size=$(du -h "${pdf_file}" | cut -f1)
+    echo "    OK (${size})"
+    count=$((count + 1))
+  else
+    echo "    PDF GENERATION ERROR"
+    errors=$((errors + 1))
+  fi
+done
+
+rm -rf "${tmpdir}"
+
+echo ""
+done_count=$(find "${OUTPUT_DIR}" -name "*.pdf" | wc -l)
+echo "=== Done: ${done_count} files in ${OUTPUT_DIR} ==="