Update strata to 0.15.0 and flea to 0.2.0

[ryanrhughes]

Update strata from 0.14.0 to 0.15.0 and flea from 0.1.6 to 0.2.0 using their published stable source archives.

• Match strata's MIT license and declare its upstream GVfs dependency.
• Add flea's kimageformats and libheif dependencies for HEIC previews on clean installations.
• Run flea's Rust suite serially: concurrent runs produced intermittent recovery-lock assertions, while all three recovery tests pass serially. Extend the existing failed-namespace-probe skips to the two new sandbox-dependent tests; these still run on builders with working namespaces.
• Fix the sync self-test's copied 1Password fixture to start at 8.12.34-36, below its mocked 8.12.35 release. This prevents real package updates from invalidating the fixture and preserves the pkgrel-reset assertion.

Validation: both upstream verification hooks passed (strata archive/tag identity; flea checksum manifest and required security fixes). Independently downloaded archive checksums match. Full Arch versions are ahead of merge-base and published applicable channels. Flea's isolated Arch package checks pass: 592 Rust tests, 10 conditional sandbox skips, 2,999 JavaScript checks, and keymap validation. The unfiltered serial Rust run passes 600 tests; its only two failures require namespaces unavailable in the container. The sync self-test passes locally.

Strata's optimized release build passes and its shared libraries resolve. Its full test suite, rerun serially from a protected checkout, reports 1,404 passed, 2 failed, and 20 ignored (some GTK tests also self-skip without a display). Portal fixture failures in the initial /tmp checkout disappear when the checkout is moved outside a world-writable parent. Two search assertions reproduce across parallel and serial runs and remain a merge blocker:

• services::search::tests::bounded_index_reaches_a_deep_file_while_broad_folders_compete — the expected deep file is absent from results.
• services::search::tests::multi_root::fair_directory_scheduling_makes_deep_progress_in_every_root — expected per-root results are absent.

No search-test skips or upstream source patches were added. PR remains draft pending investigation of these failures. No aarch64 build has been run. The automated 24-hour release-age policy is unchanged.