fix(monkeyd): make /monkeyd_crawl public and fix PDF font resolution

Advance the crawler submodule to the fix for the production failure "stat
usr/share/fonts/...: no such file or directory": the PDF writer was handing
fpdf a font path, and fpdf rewrote the absolute path into a
working-directory-relative one. Font data is now passed as bytes, with a
fallback font compiled into the binary when the host has none.

The runtime image therefore no longer installs DejaVuSans, which also removes
the font layer from the builder stage.

/monkeyd_crawl becomes public. The host allowlist and the single in-flight
export were already the controls that bound its cost; they now carry that job
alone, so both are load-bearing.

cmd/server/command_menu_test.go

@@ -67,6 +67,7 @@ func TestCommandDiscovery_AllPublicCommandsHaveSafeMetadata(t *testing.T) {
 		"gold_sell":            "<luong>",
 		"lol":                  "[date]",
 		"loldle":               "[champion]",
+		"monkeyd_crawl":        "<url>",
 		"random":               "<option,...>",
 		"stats":                "[users | user <username> | cmd <command_name>]",
 		"stock_events":         "<ticker> [days]",