fix(deps): pin dflash==0.1.0 - the DFlash2 drafter import only resolved via /tmp

The matched-DFlash2 path (--speculative-model with a DFlash2DraftModel
checkpoint) loads the drafter through z-lab's reference runtime,
`import dflash.model_mlx`. That import only resolved through an editable
install whose .pth pointed at /private/tmp/zlab-dflash - a directory the OS
periodically wipes, and which this box has wiped twice today already.

Failure mode when it goes missing: the engine still parses the flag, routes to
SimpleEngine, and reports the draft model path on /health - but
draft_model_loaded stays false and every chat silently runs plain
autoregressive at ~21 t/s while all the launch flags look correct. Observed
live before the fix; after force-installing the PyPI wheel and restarting:
enabled=true, loaded=true, and the SAME deterministic 2714-token output at
55.8 t/s (0.38s TTFT) through the real app.

dflash 0.1.0 is on PyPI, so the pin also makes the DMG bundle resolve it -
previously only dflash-mlx (the QMM kernel) was declared and a packaged app
would have shipped with the DFlash2 path dead.

Output identity across all three engines on the same prompt - plain AR 21.4,
native MTP 36.5, DFlash2 55.8 t/s, each emitting the byte-identical 2714-token
completion - is the lossless-verification proof for the speculative paths.