setup installs poppler, or an attached PDF cannot be read

Reading a PDF attachment needs `pdftoppm`. It was not installed on this machine and
is not in any package list, so the first real PDF attachment failed at the last step
— uploaded fine, landed on disk fine, unreadable.

That failure reads as the feature being broken rather than a package being absent,
which is the worst shape for something a fresh install would hit on its first try.

Added to all four managers: `poppler-utils` on apt and dnf, `poppler` on pacman and
brew.

Worth recording WHY it is needed, because it is not obvious: the agent reads a PDF by
RENDERING its pages, not by extracting text. On the document that prompted this — a
sitemap of tree diagrams and wireframes — extraction returns almost nothing and
rendering returns everything. The dependency is on the approach that works.

Installed on this machine by hand already; this is so the next one has it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/machine-setup/lib/packages.sh

@@ -94,26 +94,32 @@ pkgs_core() {
       # sources.list.d entry by hand). Left in deliberately rather than dropped
       # in the same change — it is one small package, and pulling it is a
       # separate decision from removing the tool that wanted it.
+      # poppler-utils is `pdftoppm`, and it is what makes an attached PDF readable.
+      # The agent reads a PDF by RENDERING its pages, not by extracting text — which
+      # is the only approach that works on a document made of diagrams and
+      # wireframes, where extraction returns almost nothing. Without it the attach
+      # button uploads happily and the read fails, which reads as the feature being
+      # broken rather than a package being absent.
       echo curl ca-certificates gnupg git jq unzip \
         apt-transport-https lsb-release software-properties-common \
         wget zip brotli build-essential python3 btop htop tree tmux ripgrep fd-find net-tools eza \
-        fail2ban unattended-upgrades
+        poppler-utils fail2ban unattended-upgrades
       ;;
     pacman)
       echo curl ca-certificates gnupg git jq unzip \
         wget zip brotli base-devel python btop htop tree tmux ripgrep fd net-tools eza \
-        fail2ban
+        poppler fail2ban
       ;;
     dnf)
       echo curl ca-certificates gnupg2 git jq unzip \
         wget zip brotli python3 btop htop tree tmux ripgrep fd-find net-tools eza \
-        fail2ban
+        poppler-utils fail2ban
       ;;
     brew)
       # curl, unzip and the TLS roots ship with macOS; the compilers come from
       # the Xcode command line tools, which is not a formula — see xcode_clt_*.
       # brotli is here because macOS ships the library but not the CLI.
-      echo gnupg git jq wget brotli btop htop tree ripgrep fd eza
+      echo gnupg git jq wget brotli btop htop tree ripgrep fd eza poppler
       ;;
   esac
 }