chore(pdf): complete generation 23 policy migration

[willgriffin]

Summary

• migrate the managed agent policy block to the exact generation-23 candidate
• add canonical forge metadata
• grant the lifecycle workflow the canonical actions: read permission

This unblocks the organization generation-23 smoke finalization before generation 24 can be prepared.

Validation

• generation-23 hv-agent audit
• actionlint .github/workflows/agent-policy.yml
• pnpm typecheck
• pnpm lint
• pnpm test (17 files, 162 tests)
• pnpm build
• git diff --check

Closes #127

{"schema":"hv-agent-run:v1","runtime":"codex","session":"7504D0C2-1113-40AF-AE10-E9320DA4425F","issue":127,"linked_issue":"https://github.com/happyvertical/pdf/issues/127","policy_revision":"1.0.0","status":"review","validation":["generation-23 hv-agent audit","actionlint","pnpm typecheck","pnpm lint","pnpm test: 162 tests","pnpm build","git diff --check"]}

[github-actions]

Release Preview

This PR title will not trigger an automatic release on squash merge.

Use a releaseable conventional PR title like fix(pdf): ..., feat(pdf): ..., or chore(deps): ... if this change should publish automatically.

Otherwise, add a manual changeset or apply the skip-changeset label if no release is needed.