Update default dependencies and Synapse setup

[Kubuxu]

Summary

• pin Curio to 3f3d9633c09bf1e8343e722f3c16daa4de7cce98
• resolve and pin the current main commits for filecoin-services and PDP
• work around Synapse's pnpm trust-policy and missing-lockfile failures in E2E setup

Verification

• cargo test config::tests::default_config_uses_requested_source_revisions
• cargo fmt --check
• git diff --check
• Synapse filtered pnpm install and package build smoke checks

[Kubuxu]

Multiple flows succeeded, multi upload one failed due to:

    InsufficientLockupFunds(address payer, uint256 required, uint256 available)
                           (0x47CC9101fD026fC112D7FADf6B3c9DF5bE7D4A8c, 1620000000000000000, 139556375006951753)

Which I think can be tracked back to pricing changes.

Should be addressed by FilOzone/synapse-sdk#928