fix(anydoc): rebuild truncated patched crate instead of failing cargo

A leftover .weknora-patched marker made the build skip recopying even when
Cargo.toml was missing. Require that file before reusing the tree, and build
the archive before cargo audit so CI has the gitignored patch path.

.github/workflows/anydoc.yml

@@ -57,6 +57,13 @@ jobs:
         if: steps.cargo-audit-cache.outputs.cache-hit != 'true'
         run: cargo install cargo-audit --locked
 
+      # The archive is a build artifact, not a committed blob, so CI is what
+      # keeps the vendored bindings in third_party/anydoc-go compiling.
+      # This also materializes patched-anydoc/ (gitignored); cargo audit below
+      # cannot load the crates-io patch until that tree exists.
+      - name: Build the anydoc static archive
+        run: ./scripts/build-anydoc-lib.sh
+
       # The vendored bindings pull anydoc and its PDF stack from crates.io, and
       # WeKnora parses untrusted uploads in-process. A Rust advisory there (as
       # in RUSTSEC-2026-0187, an uncatchable abort on a hostile PDF) has to
@@ -67,11 +74,6 @@ jobs:
         working-directory: third_party/anydoc-go
         run: cargo audit
 
-      # The archive is a build artifact, not a committed blob, so CI is what
-      # keeps the vendored bindings in third_party/anydoc-go compiling.
-      - name: Build the anydoc static archive
-        run: ./scripts/build-anydoc-lib.sh
-
       - name: Vet, test, and build with the engine linked in
         run: |
           go vet -tags anydoc ./internal/infrastructure/docparser/...

scripts/build-anydoc-lib.sh

@@ -55,8 +55,10 @@ prepare_patched_anydoc() {
   local dest="$crate_dir/patched-anydoc"
   # The marker records which version was patched: after a version bump the
   # copy left by the previous build is the wrong crate, and reusing it would
-  # fail deep inside cargo's patch resolution instead of here.
-  if [ -f "$dest/.weknora-patched" ] && [ "$(cat "$dest/.weknora-patched")" = "$anydoc_version" ]; then
+  # fail deep inside cargo's patch resolution instead of here. Cargo.toml is
+  # required too: a truncated leftover with only the marker would otherwise
+  # skip the copy and fail with "failed to read .../Cargo.toml".
+  if [ -f "$dest/.weknora-patched" ] && [ "$(cat "$dest/.weknora-patched")" = "$anydoc_version" ] && [ -f "$dest/Cargo.toml" ]; then
     return
   fi