CLI install should use the latest bun lockfile format and a `--frozen-lockfile` flag

[evan-gray]

Peeking further, the CLI install.sh uses bun install which is bad practice and probably outside the scope of this PR. the old bun.lockb should likely be removed and regenerated with a bun install --lockfile-only or migrated with bun install --save-text-lockfile --frozen-lockfile --lockfile-only and the install script modified to use bun install --frozen-lockfile. For more on bun lockfiles, see https://bun.com/docs/install/lockfile

Originally posted by @evan-gray in #702 (comment)

[johnsaigle]

Just to follow-up on this task, here's the output from https://github.com/asymmetric-research/locked-in/.

In addition to the points Evan raised above, there are a few locations where lock files are missing and where documentation should be updated.

Checking for package manager violations...

✗ ./.github/workflows/prettier.yml
  Error line 39: Use 'bun install --frozen-lockfile' unless repo-local bunfig.toml sets '[install].frozenLockfile = true' (https://bun.com/docs/runtime/bunfig#install-frozenlockfile)
  > echo "This usually means bun.lock is out of sync with package.json - try running 'bun install' locally and committing the updated bun.lock"

✗ ./CONTRIBUTING.md
  Error line 23: Use 'bun install --frozen-lockfile' unless repo-local bunfig.toml sets '[install].frozenLockfile = true' (https://bun.com/docs/runtime/bunfig#install-frozenlockfile)
  > If you do not do this, you may not get exactly what is specified in the file, inadvertently update dependencies, or even pull exploits down to your machine! **Never use `bun install` for this use case**.

✗ ./cli/install.sh
  Error line 150: Use 'bun install --frozen-lockfile' unless repo-local bunfig.toml sets '[install].frozenLockfile = true' (https://bun.com/docs/runtime/bunfig#install-frozenlockfile)
  > bun install

! ./cli/package.json
  Warning: Tracked manifest is missing a tracked lockfile: cli/package-lock.json, cli/npm-shrinkwrap.json, cli/pnpm-lock.yaml, cli/yarn.lock, cli/bun.lockb, cli/bun.lock
  > cli/package.json

! ./evm/ts/package.json
  Warning: Tracked manifest is missing a tracked lockfile: evm/ts/package-lock.json, evm/ts/npm-shrinkwrap.json, evm/ts/pnpm-lock.yaml, evm/ts/yarn.lock, evm/ts/bun.lockb, evm/ts/bun.lock
  > evm/ts/package.json

✗ ./sdk/README.md
  Error line 10: Use 'bun install --frozen-lockfile' unless repo-local bunfig.toml sets '[install].frozenLockfile = true' (https://bun.com/docs/runtime/bunfig#install-frozenlockfile)
  > bun install
  Error line 19: bun package installation without version pin (use 'bun add package@version')
  > bun add @wormhole-foundation/sdk-definitions-ntt
  Error line 20: bun package installation without version pin (use 'bun add package@version')
  > bun add @wormhole-foundation/sdk-evm-ntt
  Error line 21: bun package installation without version pin (use 'bun add package@version')
  > bun add @wormhole-foundation/sdk-solana-ntt
  Error line 22: bun package installation without version pin (use 'bun add package@version')
  > bun add @wormhole-foundation/sdk-route-ntt

! ./sdk/definitions/package.json
  Warning: Tracked manifest is missing a tracked lockfile: sdk/definitions/package-lock.json, sdk/definitions/npm-shrinkwrap.json, sdk/definitions/pnpm-lock.yaml, sdk/definitions/yarn.lock, sdk/definitions/bun.lockb, sdk/definitions/bun.lock
  > sdk/definitions/package.json

! ./sdk/examples/package.json
  Warning: Tracked manifest is missing a tracked lockfile: sdk/examples/package-lock.json, sdk/examples/npm-shrinkwrap.json, sdk/examples/pnpm-lock.yaml, sdk/examples/yarn.lock, sdk/examples/bun.lockb, sdk/examples/bun.lock
  > sdk/examples/package.json

! ./sdk/route/package.json
  Warning: Tracked manifest is missing a tracked lockfile: sdk/route/package-lock.json, sdk/route/npm-shrinkwrap.json, sdk/route/pnpm-lock.yaml, sdk/route/yarn.lock, sdk/route/bun.lockb, sdk/route/bun.lock
  > sdk/route/package.json

✗ ./solana/Makefile
  Error line 63: Use 'bun install --frozen-lockfile' unless repo-local bunfig.toml sets '[install].frozenLockfile = true' (https://bun.com/docs/runtime/bunfig#install-frozenlockfile)
  > bun install

! ./solana/package.json
  Warning: Tracked manifest is missing a tracked lockfile: solana/package-lock.json, solana/npm-shrinkwrap.json, solana/pnpm-lock.yaml, solana/yarn.lock, solana/bun.lockb, solana/bun.lock
  > solana/package.json

! ./sui/ts/package.json
  Warning: Tracked manifest is missing a tracked lockfile: sui/ts/package-lock.json, sui/ts/npm-shrinkwrap.json, sui/ts/pnpm-lock.yaml, sui/ts/yarn.lock, sui/ts/bun.lockb, sui/ts/bun.lock
  > sui/ts/package.json

! ./xrpl/ts/package.json
  Warning: Tracked manifest is missing a tracked lockfile: xrpl/ts/package-lock.json, xrpl/ts/npm-shrinkwrap.json, xrpl/ts/pnpm-lock.yaml, xrpl/ts/yarn.lock, xrpl/ts/bun.lockb, xrpl/ts/bun.lock
  > xrpl/ts/package.json


═══════════════════════════════════════
✗ Found 9 violation(s) and 8 warning(s) in 58 files
Tip: use lockfiles/version pins plus dependency cooldowns (minimum release age) for defense in depth.