Restore a single reproducible Bun dependency contract

[Railly]

Context

The root is Bun-first, but dependency metadata is inconsistent:

• package.json is version 0.8.0 with the current dependency set.
• package-lock.json remains at version 0.3.0 with obsolete dependencies.
• bun.lock retains the old workspace name.
• CI and release use bun-version: latest.

Different tooling therefore resolves different graphs, and CI behavior can change with a new Bun release.

Task

Make Bun the single authoritative dependency contract and pin the intended runtime version across local metadata and workflows.

Acceptance criteria

• The stale npm lockfile is removed.
• Bun lock metadata matches the current package identity without unrelated upgrades.
• packageManager declares the supported Bun version.
• CI and release use that same pinned version.
• Frozen installs pass for root, web, and VS Code.