Fix npm audit vulnerabilities and broken image build

Eleventy Image v7 removed its synchronous stats API, which broke the
build. Rather than downgrade (older versions bundle a vulnerable sharp),
adapt to v7 and clear out the remaining vulnerable dependencies:

- Make the `image` shortcode async
- Replace the unmaintained markdown-it-eleventy-img with a local plugin
  that pre-loads image metadata in eleventy.before, so markdown (and
  feed) images keep rendering as <picture> elements
- Upgrade @11ty/eleventy-fetch to v6
- Swap npm-run-all for the maintained npm-run-all2 fork
- Override eleventy-plugin-og-image's satori (and its pinned fflate) to
  patched versions, and set explicit heading weights in the OG template
  so newer satori doesn't synthesise bold text

package.json

@@ -21,7 +21,7 @@
   "license": "ISC",
   "dependencies": {
     "@11ty/eleventy": "^3.0.0",
-    "@11ty/eleventy-fetch": "^3.0.0",
+    "@11ty/eleventy-fetch": "^6.0.1",
     "@11ty/eleventy-img": "^7.1.1",
     "@11ty/eleventy-plugin-syntaxhighlight": "^5.0.0",
     "@lewisdale/blog-post-cli": "^1.0.3",
@@ -33,14 +33,13 @@
     "markdown-it": "^14.1.0",
     "markdown-it-abbr": "^2.0.0",
     "markdown-it-anchor": "^9.2.0",
-    "markdown-it-eleventy-img": "^0.10.2",
     "markdown-it-emoji": "^3.0.0",
     "markdown-it-footnote": "^4.0.0",
     "markdown-it-link-attributes": "^4.0.1",
     "markdown-it-mark": "^4.0.0",
     "markdown-it-obsidian-callouts": "^0.2.6",
     "markdown-it-prism": "^2.3.0",
-    "npm-run-all": "^4.1.5",
+    "npm-run-all2": "^9.0.4",
     "p-map": "^7.0.2",
     "postcss": "^8.4.21",
     "postcss-cli": "^10.1.0",
@@ -57,7 +56,14 @@
   },
   "allowScripts": {
     "sharp@0.35.5": false,
-    "sharp@0.33.5": false,
     "fsevents@2.3.2": false
+  },
+  "overrides": {
+    "eleventy-plugin-og-image": {
+      "satori": {
+        ".": "^0.63.2",
+        "fflate": "^0.7.5"
+      }
+    }
   }
 }