chore: refresh dependencies to latest and move CI to Bun 1.4.2

[code-yeongyu]

Summary

Bring pi-apply-patch to current dependencies and a Bun 1.4.2-based CI toolchain, review every open PR/issue, and cut a release so downstream consumers (senpi builtins / senpi install) can adopt it.

Current vs target

Dev dependencies (exact pins on the target):

package	current	target
@biomejs/biome	2.5.5	2.5.14
vitest	^4.1.10	5.0.1
typescript	7.0.2	7.0.2
@types/node	^26.1.1	26.6.2
@typescript/native-preview	^7.0.0-dev.20260707.2	7.0.0-dev.20260707.2

Peer dependencies:

package	current	target
@earendil-works/pi-agent-core	*	@earendil-works/*, * or >=0.87.0 (never ^0.87 — downstream runtimes use date versions)
@earendil-works/pi-ai	*	@earendil-works/*, * or >=0.87.0 (never ^0.87 — downstream runtimes use date versions)
@earendil-works/pi-coding-agent	*	@earendil-works/*, * or >=0.87.0 (never ^0.87 — downstream runtimes use date versions)
@earendil-works/pi-tui	*	@earendil-works/*, * or >=0.87.0 (never ^0.87 — downstream runtimes use date versions)
typebox	*	@earendil-works/*, * or >=0.87.0 (never ^0.87 — downstream runtimes use date versions)

Runtime dependencies: refresh to latest, including majors when the test suite passes (e.g. vscode-jsonrpc 9, jsdom 30, undici 8, @ast-grep/cli 0.45) — each major called out in the PR body.

Toolchain / CI:

• Bun 1.4.2 as the primary dev + CI toolchain (oven-sh/setup-bun@v2, bun install --frozen-lockfile, bun run check, bun run test), plus one npm ci consumer smoke job — extension hosts install extensions with npm by default and peer resolution disabled, so package-lock.json stays and bun.lock is added.
• Node matrix 22 / 24; actions/checkout@v7, actions/setup-node@v7; engines.node >=22.19.0.
• No packageManager field (the package must stay installable by npm, bun and pnpm).

Open PRs to decide (merge after review / close with reason / request changes with file:line)

• build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates #38 — build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates (@app/dependabot)
• build(deps): bump actions/setup-node from 6 to 7 #30 — build(deps): bump actions/setup-node from 6 to 7 (@app/dependabot)
• Align apply_patch results with Codex and support SSH backends #29 — Align apply_patch results with Codex and support SSH backends (@AMagicPear)
• build(deps): bump actions/checkout from 6 to 7 #25 — build(deps): bump actions/checkout from 6 to 7 (@app/dependabot)

Dependabot PRs are superseded by the refresh PR and are closed after it merges, each with a comment naming the superseding PR.

Open issues to triage

• Diff just disappears #16 — Diff just disappears
• Better preview rendering and crate structure refactor #12 — Better preview rendering and crate structure refactor

Acceptance criteria

• Refresh PR merged to main; CI on the merge commit is green on every matrix cell.
• bun run check and bun run test pass locally on Bun 1.4.2; npm ci && npm test passes as the consumer smoke.
• Every open PR listed above has a recorded decision; every open issue has a triage comment.
• CHANGELOG.md entry; version bumped; tag v<version> + GitHub release.
• Peer dependencies reference only @earendil-works/*.

Part of the 2026-09-24 pi-* extension cluster refresh (all sibling repos get the same treatment; senpi adopts the released versions afterwards).

[code-yeongyu]

Done in #40 (merged in fdaacf8), released as v0.1.3 (https://github.com/code-yeongyu/pi-apply-patch/releases/tag/v0.1.3). CI on the merge commit is green on every matrix cell plus the npm consumer job. PR decisions: #38, #30 and #25 were closed as superseded by #40. #29 got changes requested, with file:line blockers in its review. Issue triage: #16 is fixed in 4d159c6 (#22) and ships in v0.1.3. #12 is closed as not planned, with a note on how to contribute. Open item: the npm publish step failed with ENEEDAUTH because the repo has no NODE_AUTH_TOKEN secret. The unscoped npm name pi-apply-patch is also owned by a different maintainer, so publishing needs a package rename (for example @code-yeongyu/pi-apply-patch, which the README already uses) plus npm credentials.