fix(monkeyd): make /monkeyd_crawl public and fix PDF font resolution

Advance the crawler submodule to the fix for the production failure "stat
usr/share/fonts/...: no such file or directory": the PDF writer was handing
fpdf a font path, and fpdf rewrote the absolute path into a
working-directory-relative one. Font data is now passed as bytes, with a
fallback font compiled into the binary when the host has none.

The runtime image therefore no longer installs DejaVuSans, which also removes
the font layer from the builder stage.

/monkeyd_crawl becomes public. The host allowlist and the single in-flight
export were already the controls that bound its cost; they now carry that job
alone, so both are load-bearing.

Dockerfile

@@ -1,12 +1,6 @@
 FROM golang:1.26.5-alpine AS builder
 WORKDIR /src
 
-# The monkeyd module renders PDFs with an embedded TrueType font, and the
-# runtime image below ships no fonts at all. DejaVuSans covers the Latin
-# Extended Additional block that Vietnamese diacritics live in; it is installed
-# here and copied into the final stage.
-RUN apk add --no-cache font-dejavu
-
 # The monkeyd-crawler submodule is resolved through a `replace` directive, so
 # its go.mod must be present before `go mod download` can read the build list.
 # Only the module files are copied here, keeping this layer cached across
@@ -26,9 +20,9 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     ./cmd/server
 
 FROM gcr.io/distroless/static:nonroot
+# No fonts are installed here: the monkeyd module's PDF renderer falls back to a
+# font compiled into the binary when the host has none.
 COPY --from=builder /out/server /server
-# pdfout.FindFont() probes system font paths; this is one of the paths it knows.
-COPY --from=builder /usr/share/fonts/dejavu/DejaVuSans.ttf /usr/share/fonts/dejavu/DejaVuSans.ttf
 USER nonroot:nonroot
 EXPOSE 8080
 ENTRYPOINT ["/server"]