fix(release): unbreak packaging workflow on all three platforms

- Bump electron-builder to 26.16.1 so macOS signing passes the temp keychain
  password to set-key-partition-list (upstream #10066), which the macOS 26
  runner image now enforces
- Stat asar entries with their native path in the package audit; splitting on
  path.sep made every nested file look missing on Windows
- Run the package smoke with --no-sandbox on Linux runners without a setuid
  chrome-sandbox
- Load the packaged stats dashboard over loopback HTTP in the smoke, matching
  how the app serves it since #263, and ignore Chromium's cache-only font probe

scripts/package-audit.test.ts

@@ -134,10 +134,12 @@ test('archive inventory handles native files without counting them twice on disk
     mkdirSync(output);
     writeFileSync(path.join(input, 'main.js'), 'hello');
     writeFileSync(path.join(input, 'native.node'), 'native');
+    mkdirSync(path.join(input, 'dist', 'ai'), { recursive: true });
+    writeFileSync(path.join(input, 'dist', 'ai', 'client.js'), 'nested');
     const archive = path.join(output, 'app.asar');
     await createPackageFromStreams(
       archive,
-      ['main.js', 'native.node'].map((name) => ({
+      ['main.js', 'native.node', 'dist/ai/client.js'].map((name) => ({
         path: name,
         type: 'file',
         unpacked: name.endsWith('.node'),
@@ -148,6 +150,7 @@ test('archive inventory handles native files without counting them twice on disk
     assert.deepEqual(listAppFiles(archive), [
       { path: 'main.js', bytes: 5 },
       { path: 'native.node', bytes: 6 },
+      { path: 'dist/ai/client.js', bytes: 6 },
     ]);
     assert.equal(
       listFiles(output).reduce((sum: number, entry: { bytes: number }) => sum + entry.bytes, 0),