fix(cef): select the soft-navigation crash fix in build 3586

[zackarychapple]

Summary

CEF 151 Alloy embedders can segfault on SPA soft navigation because ReadAnythingSoftNavigationObserver calls TabInterface::GetFromContents for WebContents that is not a Chrome tab. Select CrabNebula framework 151.1.0-HEAD.3586, which carries the upstream MaybeGetFromContents fix, and align the generated version constants.

The framework source is the direct child of the previous build: upstream fix, CEF issue. Chromium remains 151.0.7922.0.

Testing

• Regenerated both macOS sys bindings from the new headers; only CEF_VERSION changed. Refreshed the same version constant for Linux/Windows and ran the derived binding/resource generators for all four targets; no derived API changes.
• Compared all 291 macOS include files: only version metadata and API-hash timestamp comments differ. All platform API hashes remain identical.
• cargo fmt --all -- --check — passed.
• python3 sys/tests/prebuilt-wrapper.py — passed (one integration test covering the Windows prebuilt-wrapper handoff, override changes, missing artifacts, and native-build fallback).
• cargo check --locked -p cef --all-features: passed (includes dox; this is a source check, not native runtime validation).
• Loaded the new framework for its API metadata only: source revision and macOS API 15101 hash match the new headers. Static arm64 disassembly shows the formerly crashing call now targets the null-safe lookup.

Manual Testing

1. Build and launch a signed macOS arm64 Alloy embedder with the updated dependency. Expected: the bundle loads framework 3586. Passed; the framework UUID was verified.
2. Perform the SPA workspace switch that previously triggered the native null dereference. Expected: the application remains responsive. Passed.
3. Navigate Home → Settings → Billing → Home → Channels. Expected: all routes load in the same native process. Passed.

No Linux or Windows runtime result is claimed.

Review notes

Based on codex/151-prebuilt-windows-wrapper at b7d425b8504cd3e7e10d193f8991aff415d10959 to preserve the existing Windows wrapper handoff. The change against that base remains five version-metadata lines. The complete route replay above used framework3586 before the Windows-wrapper base integration. A refreshed signed macOS arm64 embedder now also passes the original workspace switch with the combined head6310198885d6b84bf0e0a57124f2e65bd5d0e30e; the same native process remained alive. The complete route sequence was not repeated on that combined head.