chore: upgrade to Bun 1.4

[DarinRowe]

Summary

• Pin Bun and its type definitions to 1.4.0, centralize the CI version source, freeze installs, and parallelize the full test suite.
• Harden compiled CLI artifacts by disabling cwd configuration loading and validating ad-hoc signatures for macOS binaries.
• Document Bun 1.4 adoption decisions, migration risks, and deferred opportunities.

Files

• Runtime, lockfile, CI, release, contributor, and changelog configuration
• CLI packaging and packaging smoke coverage
• Bun 1.4 primary-source research note

Validation

• Isolated local npm install on macOS arm64, including CLI, SQLite, native-host install/verify, architecture, and strict code-sign verification
• bun install --frozen-lockfile
• bun run typecheck
• bun run test: 198 pass
• release and npm host packaging
• bun audit and bun dedupe --check
• actionlint, shell syntax, and Agent Skill distribution checks

🤖 Shipped via git-ship