CI-LOCK-02: clean checkout cannot reproduce dependencies (mutable ghostty-web ref + non-frozen CI installs)

[LeXwDeX]

Gap ID

CI-LOCK-02 (P1)

Problem

The lockfile is not authoritative, so the same commit cannot reproducibly install dependencies and CI may test a different dependency set than the lock declares:

1. Mutable git ref: packages/app/package.json pinned ghostty-web to the branch ref #main, while bun.lock recorded a stale commit (513463a). A clean checkout running bun install --frozen-lockfile failed with lockfile had changes (the manifest resolves #main to a newer commit, e.g. 83c0a07).
2. Non-frozen CI installs: the shared .github/actions/setup-bun/action.yml ran bun install without --frozen-lockfile, so CI could rewrite the lockfile and silently test a different dependency set.

Reproduced evidence

• Clean checkout bun install --frozen-lockfile → lockfile had changes (observed in oc-goal-state-machine).
• Manifest #main vs lock 513463a, resolves to 83c0a07.

Invariant violated

A clean checkout of the same commit must install the same dependencies; CI must not rewrite the lockfile.

Fix (branch fix/frozen-lockfile)

• Pin ghostty-web to immutable commit 83c0a07b8628b748aed073b232cb4b52a6ca11c1; sync bun.lock.
• Add --frozen-lockfile to all CI installs (setup-bun Linux+Windows, release-fork package-templates).
• Static repository-policy gate: fail closed if any git dep is not a full 40-char SHA or any CI bun install is not frozen (config-only, no second install flow).

Mutation-proven: reverting the pin to #main, or dropping --frozen-lockfile from any CI install, flips the gate Red.

[LeXwDeX]

已关闭：PR #232（2cf7455c4）已合并 dev@113b24ea6，dev push 全量 CI 绿（Typecheck 31560127431 ✅ / Test 31560127454 ✅ / CodeQL 31560126839 ✅ / Release Fork Build 31560127684 ✅）。dev 非默认分支故 Fixes 未自动关闭。