ci(bench): install Bun via npm instead of the policy-blocked setup-bun action (#516)

Every workflow referencing oven-sh/setup-bun (Benchmark, Testbox,
Benchmark docs) has died with a startup_failure since the action was
introduced: the repository's allowed-actions policy only permits
ubugeeei-prod-owned actions, GitHub-created actions, and an explicit
pattern list that setup-bun is not on. The failure happens before any
job starts, so the PR benchmark (including its Bun.markdown row and the
base/head comparison comment) has never actually run.

Install the same pinned Bun (1.3.14) through npm in a run step instead.
Node is already provided by the preceding Setup Vite+ step, and the
policy stays as strict as before - no new third-party action.

Author: ubugeeei

.github/workflows/benchmark-docs.yml

@@ -61,9 +61,11 @@ jobs:
       # Bun >= 1.3.8. Pin a version that ships the API so the row is always
       # present (matches .github/workflows/benchmark.yml).
       - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: "1.3.14"
+        # oven-sh/setup-bun is outside this repo's allowed-actions policy, so
+        # every workflow that referenced it died with a startup_failure before
+        # any job ran. Install the same pinned Bun through npm (Node is set up
+        # by the preceding Setup Vite+ step) instead of widening the policy.
+        run: npm install --global bun@1.3.14
 
       - name: Regenerate benchmark docs
         run: vp run bench:docs

.github/workflows/benchmark.yml

@@ -57,9 +57,11 @@ jobs:
       # Bun.markdown row. Pin a version that ships the API so the comparison
       # always includes Bun.
       - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: "1.3.14"
+        # oven-sh/setup-bun is outside this repo's allowed-actions policy, so
+        # every workflow that referenced it died with a startup_failure before
+        # any job ran. Install the same pinned Bun through npm (Node is set up
+        # by the preceding Setup Vite+ step) instead of widening the policy.
+        run: npm install --global bun@1.3.14
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

.github/workflows/testbox.yml

@@ -47,9 +47,11 @@ jobs:
       # Keep benchmark testboxes aligned with benchmark.yml and
       # benchmark-docs.yml so Bun.markdown.html is included in local remote runs.
       - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: "1.3.14"
+        # oven-sh/setup-bun is outside this repo's allowed-actions policy, so
+        # every workflow that referenced it died with a startup_failure before
+        # any job ran. Install the same pinned Bun through npm (Node is set up
+        # by the preceding Setup Vite+ step) instead of widening the policy.
+        run: npm install --global bun@1.3.14
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable