Move the toolchain to bun 1.4, and cut 0.4.13

[vvillait88]

Summary

Bumps packageManager to bun@1.4.0 and cuts 0.4.13.

oven-sh/setup-bun follows packageManager when no bun-version is given, so this one line is what moves CI, and it is the only thing that does.

Bun 1.4 does not rewrite a v1 lockfile: a plain install and a frozen install both report no changes against the committed lock, so nothing migrates to lockfileVersion 2 and older bun can still read it.

Type of change

• Docs, tests, or internal maintenance only

Public API

No CLI flag, command, output shape, or MCP tool surface changed.

But this release is not toolchain-only for users, and that is worth stating plainly. The published binaries are built with bun build --compile, so they EMBED the bun runtime. Publishing under 1.4 moves every binary user onto the 1.4 runtime, which carries its own fetch and TLS changes (network errors reject as TypeError, duplicate response headers are joined, tls.connect verifies the certificate against host when no servername is given). x64 builds are also baseline-only in 1.4, the separate haswell build having been dropped upstream.

Smoked rather than assumed, on a binary compiled here with 1.4.0: --version reports 0.4.13 (so the __VERSION__ define still injects and it is not 0.0.0-dev), the binary reports bun/1.4.0 as its embedded runtime, and check against a real production storefront returns 200 with a parsed JSON body, so TLS and HTTP work end to end through the new runtime.

Test plan

Full gate set under bun 1.4.0: lint, typecheck, test (573 passed, 2 skipped), knip, build. No test changes, because no behavior changed.

Dependency sweep for this repo, recorded so a held version does not read as an oversight:

• eslint / @eslint/js 10 and typescript 7 are held majors in the registry. Not taken.
• viem 2.55.19 and mppx 0.8.18 are exact-pinned members of the coupled settle set, which owes a live all-rails settle before it moves. Its own pass.
• incur 0.5.1 is a minor on a patched dependency (patchedDependencies pins incur@0.4.26). Per the holds registry a bump there silently detaches the patch, so it needs the patch re-tested and re-cut against the new version, with a build as the evidence. Deliberately not folded into a toolchain bump.
• @agent-score/sdk 2.7.6 is available and 2.7.7 is in flight in this same sweep, so the SDK refresh comes in the second pass after it publishes.

Bytecode compilation for the compiled binaries is worth a look separately now that bun 1.4 supports it for ES modules, since CLI startup is paid per agent lookup. Not in here, and measured before it is claimed.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests