feat(hub): expose pdf_to_md_bundle as MCP tool to agent (ADR-0027)

The Agent was falling back to Read+Write to manually parse PDFs because it
had no way to invoke the capability adapter. This adds a convert_pdf_to_md
MCP tool to the cph_hub server so the Agent can call it like send_file.

Changes:
- roleTools.ts: register convert_pdf_to_md as a CPH_HUB_MCP tool id
- fileDeliveryTool.ts: add convert_pdf_to_md tool that creates the
  PdfToMdBundleAdapter (with AliyunDocmindClient + org credential resolution)
  and invokes it with workspace-confined paths. Returns generated file paths
  + page count + cost. MCP instructions tell the Agent to always use this
  tool instead of Read/Bash for PDF parsing.
- trigger.ts: pass secretEnvelope + prisma + organizationId to the MCP
  server so it can resolve capability credentials
- hub.ts: pass secretEnvelope to makeTriggerHandler
- skills/pdf-to-md/SKILL.md: thin skill describing the workflow
  (download from Feishu → convert_pdf_to_md → send_file), when to use, and
  the fallback message if no capability connection is configured

The Agent now sees mcp__cph_hub__convert_pdf_to_md and the MCP instructions
explicitly say: 'Do NOT attempt to parse PDFs yourself with Read or Bash —
always use convert_pdf_to_md.'

Version bump 0.0.32 → 0.0.33.

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.32",
+  "version": "0.0.33",
   "private": true,
   "type": "module",
   "engines": {