fix(ci): backport complete Bun runtime/test-runner contract to dev

[medking82]

Summary

• Backport the complete Bun role contract from lidge-jun/opencodex#6713, commit 8d30945d506ff21e5bdf186de0458e4b01479d37, onto this fork's dev at 9099e4bf99166677db0f5fa6df81fe30208dd795. The 38-file patch applies without conflict and has the same stable patch ID as upstream: 72df4e23e587cb6ce059357e7076d9678c1b76c9.
• Scheduled run 38088943958 uses main's workflow but checks out dev. Old dev has neither testRunnerBun nor the composite action's role input, so the declared-runner check fails on Linux, macOS and Windows. Preserve that nightly dev checkout and all assertions.
• Keep shipped runtime Bun 1.4.2 and test runner Bun 1.4.0 distinct, including the lockfile, pinned Docker image, action, test entrypoints, regression tests and documentation. Unknown roles and malformed pins fail closed; the local runner resolver downloads nothing.
• No src/ changes, feature synchronization, version-line bump, actual runtime installation/update, merge, release, deployment or Pages setting changes. Existing Qwen and Claude bridge branches/worktrees are untouched. The GUI change is only its test script; there is no rendered UI change or corresponding screenshot.

Verification

Local Windows validation used an already-installed Bun 1.4.0 executable, called by explicit path. Dependency installation was isolated and used install --frozen-lockfile --ignore-scripts.

• bun test --isolate <file>, separately for each file below: 331 passed, 6 existing platform skips, 0 failures on final runs:
  • tests/ci-workflows/{test-runner-bun,ci-scope-gaps,install-scripts,ci-workflows,docs-bun-source-requirement,release-version-sources,release-helper,test-runner,file-size-ratchet}.test.ts
  • tests/{test-layout,test-layout-tooling}.test.ts
• File-size ratchet first exceeded its existing 5-second scan timeout during concurrent documentation building. The same command, with unchanged timeout/limits/assertions, passed after the build ended (repository scan 440 ms).
• bun node_modules/typescript/bin/tsc --noEmit: passed.
• bun scripts/structure-ssot.ts and bun scripts/privacy-scan.ts: passed.
• Docs frozen install with scripts disabled and bun node_modules/astro/bin/astro.mjs build: passed; 561 pages, 78,111 internal links checked.
• git diff --cached --check: passed; stable patch ID matches upstream; no runtime source diff.
• Security/trigger review: inspected the complete workflow, action, lockfile, Docker and release-helper diff. No changes to event triggers, permissions, immutable action refs, secret exposure, release eligibility or deployment gates. The release helper changes only test-runner selection and the fixture that contains its child execution. Candidate push and PR do not trigger release/Pages deployment.
• Full local suite and Linux/macOS execution are not claimed: this is a bounded backport with focused regression coverage; broader platform validation is left to this draft's exact-head GitHub Actions. Current-head evidence and the concrete metadata-gate blocker are recorded below. Upstream CI and the prior successful main run are not candidate-head evidence.

Current-head GitHub evidence

Full remote head: 5d85ed6391db198a75097f78e0a07c681e6b0a39. Cross-platform CI 38098737783 completed successfully at 2026-10-11 00:54 UTC: 35 successful jobs, 3 expected skips, no failed jobs.

Result	Jobs
Success	changes, select windows runner, gates, storage policy, api usage, structure gate, docs site build, docker smoke, aggregate ci
Success	Linux test 1/4, test 2/4, test 3/4, test 4/4
Success	macos 1/2, macos 2/2
Success	windows 1/9, windows 2/9, windows 3/9, windows 4/9, windows 5/9, windows 6/9, windows 7/9, windows 8/9, windows 9/9
Success	setup action ubuntu-latest, setup action macos-latest, setup action windows-latest
Success	npm-global ubuntu-latest, npm-global macos-latest, npm-global windows-latest
Success	keyring ubuntu, keyring macos, keyring windows
Success	macos widget + bundle, desktop shell (Linux AppImage, deb and packaged-shell E2E)
Expected skip	macos control: schedule or selected manual-dispatch lanes only; this was a PR event
Expected skip	remote helper: changed-path filter false
Expected skip	privacy gate: separate fallback runs only when the CI scope is false; privacy validation ran in successful gates

Each setup-action log proves runtime declared=1.4.2 resolved=1.4.2 installed=1.4.2 and test runner declared=1.4.0 resolved=1.4.0 installed=1.4.0.

Service lifecycle 38098737759: linux-systemd, macos-launchd, windows-schtasks all succeeded. React Doctor 38098737799 succeeded. PR metadata hygiene, label and resolve-pr succeeded.

Remaining gate: enforce-target reports missing UI screenshot for the single gui/package.json delta (scripts.test, +1/-1). gui/src, gui/public, gui/index.html, gui/bun.lock and gui/vite.config.ts are unchanged. This is a test-command change with no rendered UI change.

Read-only rule verification found two existing, distinct paths:

• A genuine screenshot embedded in the description is accepted by hasScreenshotEvidence; plain image links are not. Repository instructions permit uploading through the editor, or using pr-assets with a commit-SHA URL, never committing screenshot evidence to this candidate.
• hasGuiOverride also accepts an issue comment from GitHub association OWNER, COLLABORATOR or MEMBER confirming no GUI change. This PR's author association is OWNER. This comment path is separate from the gui-screenshot-waived label, whose actor must be named in MAINTAINERS.md. The earlier checkpoint only described the label path and was incomplete. Eleven existing targeted tests of these screenshot/comment rules pass.

No screenshot was fabricated or reused as current evidence. The session has the Browser skill but lacks its required node_repl js browser execution tool, so no fresh real screenshot could be captured. No waiver comment or label, maintainer-list change, permission change, or gate weakening has been applied. An authorized owner/maintainer can use the existing comment path, or supply a genuine screenshot.

This PR remains draft. Until an explicitly authorized merge into dev, scheduled runs still read unchanged old dev. No merge, runtime update, release or deployment occurred.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Keep this PR draft; no merge is authorized by this task. The local security/trigger inspection above is not an independent maintainer approval.

Co-authored-by: JUN jun@lidgeai.com

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• UI screenshot required.

What to do

• Add a screenshot of the UI change to the PR description.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.