inspector: bump WebKit so Runtime.evaluate survives validateExceptionChecks - #35333

The SIGABRT-stderr block at the bottom is unreachable on the regression path it targets: when the inspectee aborts, `reply` is `{closed:{code:1006,...}}`, so `expect(reply).toMatchObject(...)` throws inside the `try`, the `finally` runs, and the assertion error propagates straight out — lines 362–365 never run and the captured `stderr` (with the JSC "Unchecked JS exception ... @ JSInjectedScriptHostPrototype.cpp:NNN" pointer) is discarded. The PR's own fail-before transcript shows exactly this (

`urlPromise` is only ever resolved — `reject` is never destructured from `withResolvers()`. If the inspectee exits before printing the `ws://` line (plausible here since `BUN_JSC_validateExceptionChecks=1` is set and any unrelated startup-path exception-scope bug will SIGABRT before the inspector binds), the `for await` drain loop ends and `await urlPromise` blocks until the test-runner timeout, discarding the captured `stderr`. Destructure `reject` too and call it after the loop with the accumu