chore(modules): re-pin the 2026-11-03 vendor releases - #8530

These follow-up commits make the remaining v0.18.4/v0.9.5 pin work consistent: they drop the now-unnecessary senamakel→tinyhumansai rewrite for tinysecurity in the browser-egress workflow, re-pin the TinyFlows registry record and its contract test to v0.9.5, drop the fork release URL for tinysecurity, update the tinybox contract assertion, extend the ignored-test baseline, and reshape the security fixture scripts. The description already covers all of this in its re-pin table and release-gate notes; I could not verify the archive digests against the published checksum.toml from here, but nothing in the diff contradicts the description. _The code index is behind this pull request (indexed at `fad59e015bab`), so retrieved context may be out of date._

No findings.