ci: run development, quality checks and CI on Bun 1.4.3

Pin Bun 1.4.3 with packageManager, and force every bun run script onto
the Bun runtime through bunfig so ng, ESLint and Prettier never fall
back to an installed Node. Type checking uses bun check for the
application and test projects, next to the Angular build.

CI jobs install the pinned release from a checksum-verified download
instead of npm and run project steps in a shell without Node on PATH,
which stays available only for the checkout and upload actions. The
image test's fake docker runs on Bun.

Refs #290, #293

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/bun-adoption.md

@@ -4,6 +4,49 @@ Status: the agreed decisions are amended by the verification results in #289,
 recorded below. ADR 0009 remains proposed until the migration passes its final
 gate.
 
+## Status
+
+Implementation status after #290 and the local parts of #293. "Verified locally"
+means a command ran with Node unavailable (or a tripwire `node` that logs every
+start); it is not a result from the live Gitea workflow.
+
+**Done, verified locally:**
+
+- **One pinned release.** Bun 1.4.3 is pinned by `packageManager`, the
+  checksum-verified `scripts/install-bun.sh` that every CI job running project
+  commands uses (no npm), the
+  `@types/bun` version and both Docker stages. The installer refuses a
+  `package.json` that names another version. Frozen installs leave `bun.lock`
+  unchanged.
+- **Node-shebang tools on Bun.** `bunfig.toml` sets `[run] bun = true`, so
+  `start`, `build`, `watch`, `lint`, `lint:fix`, `format` and `format:check` run
+  `ng`, `eslint` and `prettier` on Bun even when Node is on `PATH`. CI also runs
+  project steps with a `PATH` that has Bun and no Node.
+- **Standalone type checking.** `bun run typecheck` runs `bun check` on the
+  application and test projects. The production build remains the only check of
+  Angular templates.
+- **Tests, coverage, benchmark, server, container** (#291, #292), and the policy
+  and image-publisher scripts with their regression tests, under Bun. The fake
+  `docker` fixture uses a `bun` shebang.
+
+**Still open:**
+
+- **Native lint and format (#290, user story 5).** Replace ESLint and Prettier in
+  one change when a stable Bun ships `bun lint` and `bun fmt`; today they exist
+  only in canary builds. Until then user story 5 and the matching #290 criteria
+  stay open.
+- **Live Gitea validation (#293).** The custom job `shell` template, the Bun
+  installer, JavaScript actions beside Node-free project steps, the benchmark's
+  timing margin and the required checks on the final PR revision have not run on
+  the live runner. The `images` job still has Alpine's `nodejs` on `PATH` for the
+  checkout action, which the project command does not use. These and the Gitea
+  activation steps remain unverified until a live pull-request run.
+- **Intermittent spec.** `real planning worker cancellation > preserves balances
+and provenance after a valid checkpoint` failed in one of three full coverage
+  runs on the development laptop (it cancels from a stage's progress callback and
+  asserts that the stage did not complete); the cause is not yet investigated.
+- **ADR 0009** stays `proposed` until the final gate.
+
 ## Problem Statement
 
 The maintainer wants VacOptimizer to use Bun as its actual JavaScript runtime and
@@ -118,7 +161,8 @@ executable plus `/usr/bin:/bin`, with `command -v node` failing.
 - **Runtime.** Package binaries with a `#!/usr/bin/env node` shebang (`ng`,
   `eslint`, `prettier`, `tsc`) run on Bun only with `--bun`. Without it they use
   Node when Node is on `PATH`, so every such command must pass `--bun`
-  explicitly. Spawned build children are native executables (esbuild,
+  explicitly. #290 sets it once for every `bun run` script with `[run] bun = true`
+  in `bunfig.toml`. Spawned build children are native executables (esbuild,
   dart-sass); Angular's workers are threads of the Bun process.
 - **Development server.** `bun --bun x ng serve` serves the application and
   direct navigation to `/benchmark` with Node unavailable.
@@ -228,7 +272,7 @@ executable plus `/usr/bin:/bin`, with `command -v node` failing.
 ## Further Notes
 
 This spec records the decisions made in the interview. The architecture record
-remains proposed, and no migration implementation or compatibility proof exists.
+remains proposed; the Status section lists what is implemented.
 The glossary receives no new terms because the choices concern general tooling,
 rather than new leave-planning concepts.