Fix CI Bun version

[michaelgbcole]

What changed

• Pin Bun to released version 1.3.14 instead of nonexistent 1.4.0.
• Convert the text lockfile header to the format understood by Bun 1.3.14 while preserving every locked dependency.

Root cause

oven-sh/setup-bun read bun@1.4.0 from package.json and failed with a 404 before any workflow step could run. Released Bun 1.3.x also rejected the lockfile's version-2 header.

Validation

Ran the full GitHub Actions sequence locally with Bun 1.3.14:

• frozen install
• typecheck
• lint
• formatting check
• control-byte check
• build, publint, and Are the Types Wrong
• Vitest gates
• standalone spec gate (64/64)