fix(org): guard external-tool assumptions in export and publishing commands

Four export/publishing commands shelled out to external tools without checking they exist, so a missing tool surfaced as an opaque process error — or, for reveal.js, a silently broken presentation. I added a command-time guard to each that names the tool and what's needed:

- zathura, in the pandoc PDF export-and-open command
- the hugo binary and the platform file-manager opener, in hugo-config
- the local reveal.js checkout (run scripts/setup-reveal.sh), shared by the reveal export and preview commands
- pandoc, in the web-clip protocol handler

The checks run only when the command runs, so startup stays quiet. Each guard has a test asserting the user-error fires when the tool is absent, and the existing happy-path tests now stub the lookups so they exercise the real path rather than tripping the new guard.

1 files changed, 4 insertions, 0 deletions

diff --git a/modules/hugo-config.el b/modules/hugo-config.el
index 94be9dd5..7afa45a7 100644
--- a/modules/hugo-config.el
+++ b/modules/hugo-config.el
@@ -109,6 +109,8 @@ new file with Hugo front matter keywords pre-filled."
               ((env-macos-p) "open")
               ((env-windows-p) "explorer.exe")
               (t "xdg-open"))))
+    (unless (executable-find cmd)
+      (user-error "Cannot open blog dir: file-manager opener %S not found on PATH" cmd))
     (start-process "hugo-file-manager" nil cmd cj/hugo-content-org-dir)))
 
 ;; ----------------------------- Draft Management ------------------------------
@@ -215,6 +217,8 @@ a template error), the sentinel reports the failure."
         (kill-process cj/hugo--preview-process)
         (setq cj/hugo--preview-process nil)
         (message "hugo server stopped"))
+    (unless (executable-find "hugo")
+      (user-error "Cannot start preview: hugo binary not found on PATH"))
     (let ((default-directory website-dir))
       (setq cj/hugo--preview-process
             (start-process "hugo-server" "*hugo-server*"