fix: align Bun toolchain with lockfile v2 maintenance

[0disoft]

Problem

Renovate lockfile maintenance rewrites both bun.lock files to lockfileVersion = 2, but CI installs Bun 1.3.13 from the root packageManager field. Bun 1.3.13 cannot parse v2 lockfiles, so dependency installation fails before tests run.

Affected PRs:

• chore(deps): upgrade Bun to 1.4.0 and refresh root lockfile #27: root bun.lock
• chore(deps): lock file maintenance #28: docs-site/bun.lock

CI reports Unknown lockfile version followed by lockfile had changes, but lockfile is frozen. The failures occur in CI runs 32657441772 and 32657453495.

Proposed resolution

Upgrade the repository toolchain declaration to Bun 1.4.0, which generates and reads lockfile v2, then rerun the existing lockfile-maintenance PRs. Keep frozen-lockfile installation enabled.

Completion criteria

• The declared Bun version can read both maintained lockfiles.
• Root and documentation-site frozen installs pass on CI.
• Existing CLI, documentation, security, and workflow checks pass before either maintenance PR is merged.

Verification

The failure was reproduced by the existing hosted CI on Linux and Windows. Local Bun 1.4.0 is available for follow-up verification; no dependency or lockfile change has been merged yet.

[0disoft]

Root toolchain alignment is complete in merged PR #27 (1114504375efaeff4af4ca1da6a9e6e0bb0f9a75).

PR #28 was rebased onto that commit and its current head 3105e6abcd0d2940664bcce6380e3721a79d0620 passes CI, Windows Node checks, CodeQL, OSV-Scanner, and GitHub Actions Hygiene. It remains open only because renovate/stability-days is pending under the configured three-day minimum release age.

This issue is reopened until #28 clears that policy gate and is merged. Repository auto-merge is disabled, so no policy bypass or deferred automatic merge was configured.

[0disoft]

Resolved by merged PRs #27 and #28. Bun toolchain alignment and both lockfile-maintenance updates are now on main.