fix(CI): validate pandoc output path before probing binary

Validate binary pandoc target formats before checking whether pandoc is
  installed. This keeps invalid input errors stable on systems without pandoc
  and fixes the CI test that expects missing output_path to be reported first.

crates/tui/src/tools/pandoc.rs

@@ -127,6 +127,19 @@ impl ToolSpec for PandocConvertTool {
             )));
         }
 
+        let resolved_output_path: Option<PathBuf> = match output_path_str {
+            Some(p) => Some(context.resolve_path(p)?),
+            None => None,
+        };
+
+        // Binary formats can't round-trip through stdout reliably —
+        // require an output_path so the bytes survive the trip.
+        if resolved_output_path.is_none() && format_is_binary(&target_format) {
+            return Err(ToolError::invalid_input(format!(
+                "target_format `{target_format}` is binary; provide an `output_path` to write the converted file."
+            )));
+        }
+
         // Resolve the pandoc binary at execution time too — registration
         // gated on resolve_pandoc(), but a concurrent uninstall between
         // catalog build and the model's call should produce a clear
@@ -141,19 +154,6 @@ impl ToolSpec for PandocConvertTool {
             )
         })?;
 
-        let resolved_output_path: Option<PathBuf> = match output_path_str {
-            Some(p) => Some(context.resolve_path(p)?),
-            None => None,
-        };
-
-        // Binary formats can't round-trip through stdout reliably —
-        // require an output_path so the bytes survive the trip.
-        if resolved_output_path.is_none() && format_is_binary(&target_format) {
-            return Err(ToolError::invalid_input(format!(
-                "target_format `{target_format}` is binary; provide an `output_path` to write the converted file."
-            )));
-        }
-
         let mut cmd = Command::new(&pandoc);
         cmd.arg(&source_path);
         cmd.arg("--to").arg(&target_format);