test: refresh three source-pin audits stale since the DFlash2 merge

The DFlash2 panel work (90a1d165e "Expose matched DFlash2 in VLM
settings") changed three pinned expressions without updating the audits
that grep for them:

- the draft-tokens slider disabled gate now exempts DFlash2 speculative
  sessions on the multimodal lane (that VLM draft is the feature),
- cacheStackActive turns the paged stack off for DFlash2 sessions
  (their multiturn reuse lives in the dflash2_runtime session store),
- the bundle pins MLX 0.32.1 (required by the four-row QMM verifier).

All three current behaviors are correct; the audits now pin them.
Remaining known-red: TestBundledPythonVerifyScript, which is the
re-bundle gate doing its job until the next bundle refresh.