feat(tests): fixture sweep, anonymized real-invoice regression corpus, CI

- test_fixture_sweep: extract+validate every fixture PDF on every run;
  known extractor/validator gaps are catalogued explicitly and the sweep
  fails on any deviation from that catalogue
- tests/fixtures/real/: anonymized XML from real production invoices that
  revealed bugs (verified to contain no real-world data); first entry
  locks in the FC-tax-number/basis-quantity/spaced-VAT-ID regressions
- CI workflow: uv sync --frozen from lockfile + pytest + docker build

tests/fixtures/MANIFEST.md

@@ -18,6 +18,17 @@ This directory contains sample PDFs for testing ZUGFeRD extraction and validatio
 | ORDER-X_EX01_ORDER_FULL_DATA-COMFORT.pdf | ORDER-X | Order-X format (related to ZUGFeRD but for orders) |
 | EmptyPDFA1.pdf | None | Empty PDF/A-1 document - no ZUGFeRD data (negative test case) |
 
+## Real-World Invoices (anonymized) - `real/`
+
+Anonymized XML from real production invoices that once revealed service bugs.
+Each file must contain **no real names, addresses, tax numbers, bank details,
+or document numbers** (verified at creation time). Never commit original
+invoice PDFs here.
+
+| Filename | Profile | Origin bug |
+|-----------|----------|------------|
+| extended_fc_steuernummer_basisqty.xml | EXTENDED | FC-only tax registration ignored, unit price with basis quantity 100 misread, spaced VAT ID rejected, contact email dropped (2026-09) |
+
 ## Profile Coverage
 
 - **MINIMUM**: Not covered (future addition)