- Add `fonts download` and `fonts verify` subcommands
- Implement Rust-based downloader (ureq + tar + flate2) with pinned sources
- Verify SHA-256 for Liberation and Noto Sans TTFs for reproducibility
- Keep binary behind `build-bin` feature; library build unaffected
Introduce `src/lib.rs` and library target so integration tests can import `docx_mcp`. Add focused `tests/args_tests.rs` verifying clap flag/env parsing and `SecurityConfig::from_args`/`from_env`. Enable clap `env` feature and guard the binary behind a `build-bin` feature to allow testing without unresolved MCP server deps. Fix `get_summary` to build owned strings safely.
These changes ensure argument options work correctly and are covered by comprehensive tests, independent of heavier integration suites.
Andy