fix(monkeyd): make /monkeyd_crawl public and fix PDF font resolution

Advance the crawler submodule to the fix for the production failure "stat
usr/share/fonts/...: no such file or directory": the PDF writer was handing
fpdf a font path, and fpdf rewrote the absolute path into a
working-directory-relative one. Font data is now passed as bytes, with a
fallback font compiled into the binary when the host has none.

The runtime image therefore no longer installs DejaVuSans, which also removes
the font layer from the builder stage.

/monkeyd_crawl becomes public. The host allowlist and the single in-flight
export were already the controls that bound its cost; they now carry that job
alone, so both are load-bearing.

internal/modules/monkeyd/monkeyd.go

@@ -39,9 +39,11 @@ func newModule(r *runner) modules.Module {
 		Commands: []modules.Command{
 			{
 				Name:       commandName,
-				Visibility: modules.VisibilityProtected,
-				// One invocation makes hundreds of outbound requests over
-				// several minutes, so it stays off the public surface.
+				Visibility: modules.VisibilityPublic,
+				// Public despite being expensive: one invocation makes
+				// hundreds of outbound requests over several minutes. The
+				// host allowlist and the single in-flight export are what
+				// bound the cost, so both are load-bearing here.
 				Description: "Export a " + AllowedHostsHint + " novel as a PDF",
 				Parameters:  "<url>",
 				Handler:     r.handle,