fix(ci): resolve Brewfile tap and helium install failures

Add the Bun tap required by brew validation and make /opt immutable so helium-bin can unpack cleanly during image builds.

Assisted-by: openai/gpt-5.3-codex via OpenCode

Author: Stephen

Containerfile

@@ -63,7 +63,7 @@ FROM ghcr.io/ublue-os/bluefin:stable
 ## Uncomment the following line if one desires to make /opt immutable and be able to be used
 ## by the package manager.
 
-# RUN rm /opt && mkdir /opt
+RUN rm /opt && mkdir /opt
 
 ### MODIFICATIONS
 ## Make modifications desired in your image and install packages by modifying the build scripts.

custom/brew/default.Brewfile

@@ -13,6 +13,7 @@ brew "rg"         # ripgrep - faster grep
 brew "gh"         # GitHub CLI
 brew "git"        # Git version control
 brew "neovim"     # Neovim text editor
+tap "oven-sh/bun"
 brew "oven-sh/bun/bun" # JavaScript runtime and package manager
 brew "nvm"        # Node version manager