ci: pin bun to 1.3.9 to keep lockfile reproducible

Bun 1.3.13 rolled out mid-PR and resolves the lockfile slightly
differently from 1.3.9, causing --frozen-lockfile to fail even
without any dep change. Pin the setup-bun action to 1.3.9 so CI
matches the lockfile that was committed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rsbh

.github/workflows/ci.yml

@@ -19,6 +19,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
 
       - name: Install dependencies
         run: bun install --frozen-lockfile