fix(release): unbreak packaging workflow on all three platforms

- Bump electron-builder to 26.16.1 so macOS signing passes the temp keychain
  password to set-key-partition-list (upstream #10066), which the macOS 26
  runner image now enforces
- Stat asar entries with their native path in the package audit; splitting on
  path.sep made every nested file look missing on Windows
- Run the package smoke with --no-sandbox on Linux runners without a setuid
  chrome-sandbox
- Load the packaged stats dashboard over loopback HTTP in the smoke, matching
  how the app serves it since #263, and ignore Chromium's cache-only font probe

package.json

@@ -85,9 +85,9 @@
   },
   "overrides": {
     "@xmldom/xmldom": "0.8.15",
-    "app-builder-lib": "26.15.3",
+    "app-builder-lib": "26.16.1",
     "brace-expansion": "5.0.9",
-    "electron-builder-squirrel-windows": "26.15.3",
+    "electron-builder-squirrel-windows": "26.16.1",
     "fast-uri": "3.1.6",
     "form-data": "4.0.6",
     "ip-address": "10.2.0",
@@ -129,7 +129,7 @@
     "@types/node": "^24.10.0",
     "@types/ws": "^8.18.1",
     "electron": "42.6.0",
-    "electron-builder": "26.15.3",
+    "electron-builder": "26.16.1",
     "esbuild": "^0.25.12",
     "eslint": "^10.8.0",
     "prettier": "^3.8.1",