ci(renovate): disable artifact updates for bun and npm

[marcusrbrown]

No description provided.

[fro-bot]

Verdict: PASS

Config-only change to .github/renovate.json5 (+8/-0), no application code touched. Adds a packageRules entry with matchManagers: ['bun', 'npm'] and skipArtifactsUpdate: true, with an inline comment explaining why: bfra-me/renovate-action sets RENOVATE_BINARY_SOURCE=install, which makes Renovate's built-in artifact-update path invoke install-tool bun <ver> and fail in this environment. The existing postUpgradeTasks block (bun install, bun run fix, executionMode: 'branch') already regenerates bun.lock and reformats, so disabling the built-in artifact update is redundant-safe rather than a functional gap.

Verified:

• JSON5 is well-formed and consistent with the file's existing packageRules style/ordering.
• postUpgradeTasks.commands (line 51) does run bun install after this rule, confirming the comment's claim that lockfile regeneration still happens.
• No plugin/TypeScript code, tool hooks, or system prompts are affected — the TS/ESM/Biome/class-avoidance review criteria don't apply to this diff.
• No breaking change to any plugin API surface.

Blocking issues

None

Non-blocking concerns

None — the change is narrowly scoped and the inline comment gives sufficient future-maintainer context.

Missing tests

None applicable — Renovate config has no test harness in this repo; correctness is validated by Renovate's own JSON5 schema at runtime and by observing the next dependency PR's artifact behavior.

Risk assessment: LOW

Blast radius is limited to Renovate's automated dependency-update workflow. Worst case if misconfigured: bun.lock drifts from package.json in a Renovate PR, which is user-visible and easily caught by CI (lockfile check) before merge. No effect on production code, runtime behavior, or security surface.

---

Run Summary

Field	Value
Event	pull_request
Repository	marcusrbrown/systematic
Run ID	29901935414
Cache	hit
Session	ses_077e2a8c2ffeUuzrQhY45U4dcz