chore: refresh dependencies and move CI to Bun 1.4.2

[code-yeongyu]

Summary

• Refresh dev dependencies to the 2026-09-24 pins and add the pi runtime packages as exact devDependencies so tests run against @earendil-works/pi-* 0.87.1.
• Move CI and the publish verification steps to Bun 1.4.2, widen the matrix to Node 22/24, and add an npm ci && npm test consumer job.
• Release 0.1.3 (patch: dependencies and tooling only; no contributor feature lands in this round).

Fixes #39
Fixes #16 (the fix already shipped on main in 4d159c6 / #22; this release is the first tag that contains it)

Versions

package	field	old	new
@biomejs/biome	devDependencies	2.5.5	2.5.14
vitest	devDependencies	^4.1.10	5.0.1 (major)
typescript	devDependencies	7.0.2	7.0.2
@types/node	devDependencies	^26.1.1	26.6.2
@typescript/native-preview	devDependencies	^7.0.0-dev.20260707.2	7.0.0-dev.20260707.2
@earendil-works/pi-agent-core	devDependencies	-	0.87.1
@earendil-works/pi-ai	devDependencies	-	0.87.1
@earendil-works/pi-coding-agent	devDependencies	-	0.87.1
@earendil-works/pi-tui	devDependencies	-	0.87.1
diff	dependencies	^9.0.0	^9.0.0 (already latest 9.0.0)
typebox	peer -> dependencies	*	^1.3.34
@earendil-works/pi-*	peerDependencies	*	*
engines.node		>=22.0.0	>=22.19.0

Majors: vitest 4 -> 5. The full suite passes (61/61). No vi.mock usage, so the vitest 5 mock-reset and hoisting changes do not apply. The only test change is typing: pi 0.87 ExtensionAPI.on returns an unsubscribe function, so the test stubs now return one.

typebox moved out of peers so that peerDependencies lists only @earendil-works/pi-*. The pi extension loader aliases typebox to the host copy, so the runtime still uses the host's TypeBox.

Other changes:

• biome migrate --write: linter.rules.recommended -> linter.rules.preset. No new lint findings.
• files allowlist (src, CHANGELOG, NOTICE, plus npm defaults) so the tarball no longer ships bun.lock, .github/ and tests: 22 files -> 7 files, 52.2 kB -> 15.7 kB.
• README, AGENTS.md and the PR template show Bun dev commands. The npm consumer install instructions are unchanged.
• No packageManager field. There is no .npmrc.

CI

• test: ubuntu-latest / macos-latest x Node 22 / 24, actions/checkout@v7, actions/setup-node@v7, oven-sh/setup-bun@v2 (bun 1.4.2), bun install --frozen-lockfile, bun run check, bun run test, npm pack --dry-run.
• npm-consumer: ubuntu-latest, Node 22, npm ci, npm test.
• publish.yml: verification now uses Bun 1.4.2. Publishing still uses npm publish --access public --provenance with NODE_AUTH_TOKEN and id-token: write.

Open PR decisions

• build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates #38, build(deps): bump actions/setup-node from 6 to 7 #30, build(deps): bump actions/checkout from 6 to 7 #25 (dependabot): superseded by this PR. Each will be closed after merge with a comment naming this PR.
• Align apply_patch results with Codex and support SSH backends #29: reviewed with changes requested. The blockers are listed with file:line in the review: the hunks-only diff counts context lines as churn, the api-based provider gate from feat: support custom Responses providers #33 is regressed, cwd containment from before Fix apply_patch path handling and final diff preview #22 comes back, blank lines are dropped from the preview, and the SSH layer bypasses the fix: serialize patch file mutations #28 mutation queue.

Verification (local, Bun 1.4.2, Node 26)

• bun install --frozen-lockfile: ok
• bun run check: ok
• bun run test: 61 passed
• rm -rf node_modules && npm ci && npm test: 61 passed
• npm pack --dry-run: 7 files

[code-yeongyu]

Merging with the admin bypass. CI run 35965820752 is green on head e99e2f5 for every matrix cell and the npm consumer job. The branch ruleset requires one approving review, which the PR author cannot give, and its required status contexts still list node 20 jobs that no workflow has produced since the matrix moved to Node 22. The ruleset contexts should be updated to the new node 22 / node 24 job names separately.