Bun 1.4.2: pin, types, pointer narrowing, renderer NODE_ENV per command

[ipfizz]

What changed in Bun 1.4 that touches Bunmaska

• bun:ffi is engine-native (3x faster). cstring returns are plain strings and null for NULL; our three cstring symbols already call toString() on the value, so nothing changes. bun-types 1.4 widens FFIType.ptr returns to Pointer | bigint | null; the runtime still returns numbers (probed on 1.4.2), so a narrowing dlopen wrapper in src/main/platform/dlopen.ts keeps every call site typed as before. 36 loader files rewired mechanically.
• "jsx": "react-jsx" now emits jsx, not jsxDEV, unless NODE_ENV=development is defined. Our renderer build used to force development as a workaround; it now defines NODE_ENV per command (dev = development, build = production). Works the same on Bun 1.3. Packaged apps stop shipping the React development runtime.
• Nothing else in the 1.4.0 / 1.4.1 / 1.4.2 behaviour-change lists hits this codebase (no Bun.$ globs, no fs.rmdir recursive, no Temporal, bunfig parses under the strict TOML parser, lockfile stays v1).

Verification

• bun run validate green locally on Bun 1.4.2 (1623 tests). Website builds.
• CI on this PR is the Linux and Windows run on 1.4.2 (.bun-version bumped, setup-bun reads it).
• engines.bun stays >=1.3.0.

Noted, not done

• bun test --isolate on the unit suite finds two tests that only pass because the ObjC class registration one-shot guard is module state while the class itself is process state. Making defineObjcClass idempotent would let us adopt --isolate for unit tests.