fix: lock pdfjs release builds and expose worker warmup

[vitormattos]

Summary

• track the package lockfile so release installs stay pinned to the intended pdfjs-dist version
• add a dist validator plus a prepack guard to fail when the bundled runtime, worker and lockfile drift apart
• expose ensureWorkerReady() so LibreSign can warm up the package worker without importing its own pdfjs-dist worker path
• bump the package to 1.1.6

Validation

• npm ci
• npm test
• npm run build
• npm run validate:dist