Fix CI: stale override in bun.lock, and pin the Bun version

CI was failing on `bun install --frozen-lockfile`:

    error: lockfile had changes, but lockfile is frozen
    note: overrides in package.json changed since bun.lock was saved

My fault, from the djsx removal. That commit dropped
`"overrides": {"react": "./djsx/index.ts"}` from package.json but bun.lock
still recorded it. Bun 1.3.11, which I had locally, accepted the mismatch
under --frozen-lockfile, so the clean-install check I ran passed. Bun 1.4.0,
which CI resolved from `bun-version: latest`, rejects it.

Regenerated bun.lock so its overrides block matches package.json. Reproduced
the exact failure on 1.4.0 first, then confirmed a clean
`bun install --frozen-lockfile` succeeds.

Also pinned the workflow to bun-version "1.4.0" instead of `latest`. The
lockfile format is version sensitive, and a Bun release landing upstream
should not be able to break CI on an unrelated commit. Bumping it is now a
deliberate change with its own diff.

Verified on 1.4.0: frozen install, typecheck and lint all pass from an empty
node_modules.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015hDX4g1EjTN7424A5wnptE

Author: claude

.github/workflows/ci.yml

@@ -15,7 +15,10 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          # Pinned rather than `latest`: the lockfile format is version
+          # sensitive, and a new Bun landing upstream should not be able to
+          # break CI on an unrelated commit. Bump deliberately.
+          bun-version: "1.4.0"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile