<conjecture>
Just as an off-the-cuff reaction to this, I don’t think you want to add these headers to your response:
I believe you want your HTMX response to only be:
Which should then allow the iframe tag to retrieve the PDF as part of its normal processing. It’s the request generated by the iframe that needs to yield a response containing the pdf content type.