fix(site): pin xpkgindex with click-controlled phone navigation

[Sunrisepeak]

Summary

Fix phone navigation by updating the site generator to immutable commit 2d3dd90dde89383e457a1ad6d5d87d4c75d697e5 (xpkgindex #12). The menu opens and closes on click/tap instead of hover/focus, and hidden document links cannot receive input.

Replace floating Git installations with one .xpkgindex/requirements.txt shared by deployment, site-check and cache refresh. Generator updates become explicit reviewed changes; the existing .xpkgindex/** path filters trigger site-check and deployment for a pin update.

Test plan

• Upstream PR CI passed, including Chromium/WebKit navigation regressions, Python 3.9/3.12/3.13, documentation checks and a real consumer build.
• Offline strict build: 244 packages.
• Generated English, Chinese and Traditional Chinese homepages pass Chromium and WebKit touch-menu smoke checks.
• Consumer site-check validates the pinned dependency and strict build before merging.