ci: --frozen-lockfile is a no-op — bun.lock is gitignored #107

Problem

.github/workflows/ci.yml runs bun install --frozen-lockfile, but bun.lock is gitignored
(.gitignore:5, since the repo's first commit) and no lockfile of any ecosystem is tracked. Bun
does not fail when the lockfile is simply absent — it installs and moves on — so the flag is a
silent no-op and every CI run resolves dependencies fresh from the registry.

Reproduced on a clean clone of main:

$ git clone --branch main --single-branch <repo> /tmp/frozen && cd /tmp/frozen
$ ls -a | grep -i lock          # nothing
$ bun install --frozen-lockfile
250 packages installed [5.49s]
exit=0

The flag reads as "reproducible install" and delivers the opposite. Two consequences:

• CI cannot reproduce a past run, and a green result says nothing about which versions were green.
• A transitive publish between two runs changes what is tested with no diff to show for it.

The workflow author clearly expected a lockfile — the flag has no other purpose — so the ignore and
the CI step contradict each other. One of them is wrong.

Scope boundary

Resolve the contradiction. Not in scope: the artifact layer's dependency parsing, which reads
lockfiles from the analyzed project and is unaffected by what this repo tracks for itself.

Goals

Pick one, then make the tree and the workflow agree:

• Track bun.lock — negate it in .gitignore and commit it, making --frozen-lockfile
  real. Reproducible CI; a renovate-style bump becomes a reviewable diff.
• Or drop --frozen-lockfile — keep the lockfile untracked and stop claiming pinning.
  Honest, and keeps the repo's existing no-lockfiles convention.

Caveats and known risks

• Tracking a lockfile reverses a convention held since the first commit; it is a maintenance
  commitment, not just a file.
• The blanket bun.lock ignore already caused a separate bug: it swallowed
  test/fixtures/artifacts-app/packages/web/bun.lock, whose three sibling lockfiles were tracked,
  breaking two tests on any clean checkout (fixed on feat/issue-101-artifacts). Whichever option
  is chosen, the pattern should distinguish this repo's own lockfile from test data.
• Dropping the flag makes an existing weakness explicit rather than introducing one.

Definition of done

A clean clone plus the CI install step either installs the exact versions recorded in a tracked
lockfile, or makes no claim to. Verified by running the workflow's install command in a fresh
clone, not by reading the YAML.