deps: take zat v0.3.18 with the websocket setsockopt fix
Moves zat 649dae3 -> 8db0560 (v0.3.18) and websocket 11e0f5c -> 73429df. Both pins move together on purpose: zat pins websocket too, so bumping one alone gives the build two copies and fails with "file exists in modules 'build' and 'build0'". This is the fix for the abrupt-disconnect abort, now reaching Stream through released dependencies rather than a local checkout. Full suite clean across 10 Debug and 8 ReleaseSafe runs, where it previously aborted about one run in seven, plus differential-oracle and the pinned-client archive contract. Audit: firehose reconnect blocked -> resolved, with the evidence coming from the fetched packages. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>