fix(resources,deps): pin Swift to the Xcode toolchain; clear audit advisories

Three fixes found while doing a cold local sync.

1. Swift helper scripts spawned a bare `swift`, i.e. whatever PATH
   resolves first. On a machine with a toolchain manager (swiftly here,
   Swift 6.5-dev) that is an open-source build with no macOS SDK stubs,
   and our scripts run in interpreter/JIT mode linking AppKit at runtime.
   Every render died at JIT link time:

     JIT session error: Symbols not found: [ _OBJC_CLASS_$_NSImage,
     _NSFontWeightRegular, _OBJC_CLASS_$_NSImageSymbolConfiguration, … ]

   surfacing as a flood of "worker exited" pre-render failures — 867 in
   the first three minutes of a sync, and a snapshot that would have
   shipped with essentially no rendered symbols. CI never caught it: the
   runner images have exactly one Swift on PATH, Xcode's.

   src/resources/swift-binary.js now resolves the driver once via
   `xcrun -f swift` (honours xcode-select and DEVELOPER_DIR), falling back
   to /usr/bin/swift and finally to PATH on non-macOS. All five spawn
   sites use it: the symbol worker, the codepoint dump, both symbol
   renderers, and the font-text renderer. Verified end-to-end — a symbol
   that failed all 27 weight/scale variants now renders 27/27.

2. `bun audit` had been failing CI on 5 advisories (2 high) reachable
   through @modelcontextprotocol/sdk. The overrides existed but their
   floors sat exactly on the vulnerable versions: fast-uri ^4.1.1 (fixed
   in 4.1.2), ip-address ^10.2.0 (fixed after 10.3.0), hono ^4.12.32
   (fixed in 4.12.34). Raised to ^4.1.2 / ^10.4.0 / ^4.13.0 and re-locked;
   audit is clean.

3. The headless-Chromium search-worker test skipped on "no documents" but
   not on a PARTIAL corpus. A machine mid-sync has COUNT(*) > 0 while the
   page the probe asserts on has not been crawled, so the test went red
   for a reason it explicitly meant to skip for. It now gates on the
   actual fixture it probes.

Suite: 2507 pass, 12 skip, 0 fail. Audit clean.