feat: rebrand to MMD PDF, single corporate theme, and remove original text under an edit

- Services/PdfRedactText.cs: strip text whose origin falls inside a CoverAnnotation
  from the page content stream at save time, hooked into PdfBurn.DrawAnnotationsIntoDoc.
  Fixes edited values staying recoverable by text extraction.
- Themes/MMD.xaml replaces all thirteen themes; picker and accent strip removed; no dark mode.
- Rename KillerPDF -> MMD PDF across code, resources, packaging and locale strings; new icon.
- Remove the upstream author credit and the in-app install button.

Features/Cli/BatchRunner.cs

@@ -5,15 +5,15 @@ using System.Runtime.InteropServices;
 using System.Text;
 using PdfSharpCore.Pdf;
 using PdfSharpCore.Pdf.IO;
-using KillerPDF.Services;
+using MmdPdf.Services;
 
-namespace KillerPDF.Features
+namespace MmdPdf.Features
 {
     // ============================================================
     // Headless CLI batch mode
     // ============================================================
     //
-    // KillerPDF.exe --batch-resave <input.pdf|inputDir> <output.pdf|outputDir> [--log <file.csv>] [--quiet]
+    // MmdPdf.exe --batch-resave <input.pdf|inputDir> <output.pdf|outputDir> [--log <file.csv>] [--quiet]
     //
     // Resaves one PDF (or every *.pdf under a folder tree, mirroring the
     // relative structure into the output folder) through the same pipeline a
@@ -25,7 +25,7 @@ namespace KillerPDF.Features
     //
     // Built for the veraPDF validation harness (validation/): baseline the
     // corpus, --batch-resave it, validate the output tree, then diff with
-    // validation/Compare-VeraPDF.ps1. The claim being tested is "a KillerPDF
+    // validation/Compare-VeraPDF.ps1. The claim being tested is "a MmdPdf
     // save does not degrade standards conformance".
     //
     // Exit codes: 0 = every file OK or SKIP, 1 = at least one FAIL
@@ -34,7 +34,7 @@ namespace KillerPDF.Features
     // Invoked from App.OnStartup BEFORE the single-instance mutex, so a batch
     // run works even while a GUI instance is open and never forwards to it.
     //
-    // KillerPDF builds as a GUI-subsystem exe, so it has no console of its
+    // MmdPdf builds as a GUI-subsystem exe, so it has no console of its
     // own; AttachConsole(-1) latches onto the parent terminal when launched
     // from one. Output interleaves with the prompt (standard GUI-app quirk) -
     // the authoritative record is the --log CSV and the exit code.
@@ -82,7 +82,7 @@ namespace KillerPDF.Features
 
             if (badUsage || string.IsNullOrWhiteSpace(input) || string.IsNullOrWhiteSpace(output))
             {
-                con.WriteLine("Usage: KillerPDF.exe --batch-resave <input.pdf|inputDir> <output.pdf|outputDir> [--log <file.csv>] [--quiet]");
+                con.WriteLine("Usage: MmdPdf.exe --batch-resave <input.pdf|inputDir> <output.pdf|outputDir> [--log <file.csv>] [--quiet]");
                 exitCode = 2;
                 return true;
             }