ci: run development, quality checks and CI on Bun 1.4.3

Pin Bun 1.4.3 with packageManager, and force every bun run script onto
the Bun runtime through bunfig so ng, ESLint and Prettier never fall
back to an installed Node. Type checking uses bun check for the
application and test projects, next to the Angular build.

CI jobs install the pinned release from a checksum-verified download
instead of npm and run project steps in a shell without Node on PATH,
which stays available only for the checkout and upload actions. The
image test's fake docker runs on Bun.

Refs #290, #293

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -9,6 +9,11 @@ on:
 permissions:
     contents: read
 
+# Gitea's checkout and upload-artifact actions are JavaScript actions that the runner
+# executes with the job container's own `node`, so those containers keep Node. Project
+# commands never use it: the jobs that run them install the pinned Bun with
+# scripts/install-bun.sh and run `run:` steps under a shell whose PATH has Bun but no Node.
+
 concurrency:
     group: ci-${{ github.event_name }}-${{ github.ref }}
     cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
@@ -18,6 +23,9 @@ jobs:
         name: policy
         runs-on: ubuntu-latest
         container: node:24.21.0
+        defaults:
+            run:
+                shell: env PATH=/opt/bun/bin:/usr/bin:/bin bash -e {0}
         outputs:
             slug: ${{ steps.policy.outputs.slug }}
             tag: ${{ steps.policy.outputs.tag }}
@@ -26,37 +34,45 @@ jobs:
               with:
                   fetch-depth: 0
                   persist-credentials: false
+            - name: Install Bun
+              run: sh scripts/install-bun.sh
             - name: Policy regression tests
-              run: node scripts/ci-policy.test.mjs && node scripts/ci-image.test.mjs
+              run: bun scripts/ci-policy.test.mjs && bun scripts/ci-image.test.mjs
             - name: Validate event and commit
               id: policy
-              run: node scripts/ci-policy.mjs
+              run: bun scripts/ci-policy.mjs
 
     validate:
         name: validate
         runs-on: ubuntu-latest
         container: node:24.21.0
+        defaults:
+            run:
+                shell: env PATH=/opt/bun/bin:/usr/bin:/bin bash -e {0}
         steps:
             - uses: https://gitea.com/actions/checkout@v4
               with:
                   persist-credentials: false
-            - run: npm install --global bun@1.4.2
+            - name: Install Bun
+              run: sh scripts/install-bun.sh
             - run: bun install --frozen-lockfile
             - run: bun run lint
             - run: bun run format:check
-            - run: bunx prettier --check 'scripts/ci-*.mjs' '.gitea/workflows/*.yml'
-            - run: bunx tsc --noEmit -p tsconfig.app.json
-            - run: bunx tsc --noEmit -p tsconfig.spec.json
+            - run: bun run typecheck
 
     test:
         name: test
         runs-on: ubuntu-latest
         container: node:24.21.0
+        defaults:
+            run:
+                shell: env PATH=/opt/bun/bin:/usr/bin:/bin bash -e {0}
         steps:
             - uses: https://gitea.com/actions/checkout@v4
               with:
                   persist-credentials: false
-            - run: npm install --global bun@1.4.3
+            - name: Install Bun
+              run: sh scripts/install-bun.sh
             - run: bun install --frozen-lockfile
             - run: bun scripts/generate-langs.js
             - name: Functional coverage
@@ -79,11 +95,15 @@ jobs:
         container:
             image: node:24.21.0
             options: --memory=3g
+        defaults:
+            run:
+                shell: env PATH=/opt/bun/bin:/usr/bin:/bin bash -e {0}
         steps:
             - uses: https://gitea.com/actions/checkout@v4
               with:
                   persist-credentials: false
-            - run: npm install --global bun@1.4.3
+            - name: Install Bun
+              run: sh scripts/install-bun.sh
             - run: bun install --frozen-lockfile
             - run: bun scripts/generate-langs.js
             - name: Benchmark protocol with relative gate
@@ -93,11 +113,15 @@ jobs:
         name: build
         runs-on: ubuntu-latest
         container: node:24.21.0
+        defaults:
+            run:
+                shell: env PATH=/opt/bun/bin:/usr/bin:/bin bash -e {0}
         steps:
             - uses: https://gitea.com/actions/checkout@v4
               with:
                   persist-credentials: false
-            - run: npm install --global bun@1.4.2
+            - name: Install Bun
+              run: sh scripts/install-bun.sh
             - run: bun install --frozen-lockfile
             - run: bun run build -- --configuration production
             - uses: https://gitea.com/actions/upload-artifact@v3
@@ -176,17 +200,21 @@ jobs:
             run:
                 shell: sh
         steps:
-            - name: Install checkout and policy runtimes
-              run: apk add --no-cache nodejs git
+            # Alpine's nodejs package is for the checkout action only (it shares /usr/bin
+            # with git); Bun needs libgcc and libstdc++ and the installer needs curl.
+            - name: Install checkout runtime and tools
+              run: apk add --no-cache nodejs git curl libgcc libstdc++
             - uses: https://gitea.com/actions/checkout@v4
               with:
                   fetch-depth: 0
                   persist-credentials: false
+            - name: Install Bun
+              run: sh scripts/install-bun.sh
             - name: Build branch images or promote a release
               env:
                   REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
                   REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-              run: node scripts/ci-image.mjs
+              run: /opt/bun/bin/bun scripts/ci-image.mjs
 
     required:
         name: required