build(sdlc): convert the rendered PDFs to Word in build-sdlc-delivery.sh

Uses local pdf2docx when present, else a throwaway python container.

scripts/build-sdlc-delivery.sh

@@ -34,6 +34,34 @@ while IFS= read -r -d '' source; do
   node "$TOOL_DIR/render-sdlc.mjs" "$source" "$destination"
 done < <(find "$SOURCE_DIR" -type f -name '*.md' -print0 | sort -z)
 
+# Every .pdf gets a Word copy beside it, reconstructed from the rendered page.
+# The CI header bands need Playwright, so they are rendered here with node and
+# handed to the converter, which then only needs Python with pdf2docx: the local
+# interpreter ($PYTHON) when it has it, otherwise a throwaway python container.
+BAND_DIR="$(mktemp -d)"
+trap 'rm -rf "$BAND_DIR"' EXIT
+echo "Rendering CI header bands..."
+node "$TOOL_DIR/render-ci-band.mjs" "$SOURCE_DIR" "$BAND_DIR"
+
+echo "Converting PDFs to Word..."
+PYTHON="${PYTHON:-python3}"
+if "$PYTHON" -c 'import pdf2docx, docx' 2>/dev/null; then
+  "$PYTHON" "$TOOL_DIR/convert-to-docx.py" "$SOURCE_DIR" "$STAGING_DIR" "$BAND_DIR"
+elif command -v docker >/dev/null 2>&1; then
+  PY_CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/sdlc-delivery-python"
+  mkdir -p "$PY_CACHE"
+  docker run --rm --user "$(id -u):$(id -g)" -e HOME=/tmp -e PYTHONPATH=/py \
+    -v "$ROOT_DIR:$ROOT_DIR" -v "$BAND_DIR:$BAND_DIR:ro" -v "$PY_CACHE:/py" \
+    -w "$ROOT_DIR" python:3.12-slim sh -c '
+      python -c "import pdf2docx, docx" 2>/dev/null ||
+        pip install --quiet --disable-pip-version-check --target /py -r "$1"
+      shift; python "$@"' _ \
+    "$TOOL_DIR/requirements.txt" "$TOOL_DIR/convert-to-docx.py" "$SOURCE_DIR" "$STAGING_DIR" "$BAND_DIR"
+else
+  echo "pdf2docx is not available: pip install -r $TOOL_DIR/requirements.txt, or install docker." >&2
+  exit 1
+fi
+
 echo "Verifying staged delivery package..."
 "$SCRIPT_DIR/verify-sdlc-delivery.sh" "$STAGING_DIR"
 

scripts/sdlc-seed/README.md

@@ -25,7 +25,7 @@ Approval signature tables on every document.
 
 ```bash
 node scripts/sdlc-seed/build.mjs      # regenerate sdlc/ only
-bash scripts/build-sdlc-delivery.sh   # seed, render to PDF, then verify
+bash scripts/build-sdlc-delivery.sh   # seed, render to PDF and Word, then verify
 ```
 
 The traceability chain is validated at import time: every Customer Requirement