saveForSigning

Serialize incrementally, locate the /Contents placeholder, patch the /ByteRange in place (space-padded to the reserved width so no offset moves), and return the bytes plus the range: [0, start] and [end, size-end] cover the whole file except the hex string itself.