Verify the Bun download checksum in the bun-node container image #227

Problem

packages/containers/bun-node/Dockerfile installs Bun with curl -fsSL https://bun.sh/install | bash -s -- "bun-v${BUN_VERSION}". Nothing verifies the bytes. The version is pinned (from package.json packageManager since #226), but the artifact is not, so a compromised bun.sh or a swapped release asset would go into every image built from it. This was raised in the #226 review and deferred there because the fix needs per-arch plumbing that could not be verified locally.

Why it is not a one-liner

• packages/containers/script/build.ts pushes linux/amd64,linux/arm64, so each Bun bump needs at least two checksums: bun-linux-x64.zip and bun-linux-aarch64.zip.
• The install script picks bun-linux-x64-baseline.zip on x64 hosts without AVX2. A checksum install has to choose one variant explicitly. Baseline is the safe default for a CI image.
• The base image is ghcr.io/anomalyco/build/base:24.04, so the change has to be tested with docker buildx on both platforms.

Proposed design

1. Add a checked-in packages/containers/bun-node/bun.sha256 in SHASUMS256.txt format, holding only the needed assets (bun-linux-x64-baseline.zip, bun-linux-aarch64.zip) for the pinned version. That file is the one place to update on a Bun bump: copy the two lines from that release's SHASUMS256.txt, after checking it against the release's signed SHASUMS256.txt.asc.
2. In the Dockerfile, COPY that file and map TARGETARCH to the asset name (amd64 to x64-baseline, arm64 to aarch64). Download https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-${asset}.zip, run grep " bun-linux-${asset}.zip$" bun.sha256 | sha256sum -c -, and unzip into /opt/bun/bin (the current BUN_INSTALL). Drop curl | bash.
3. Extend packages/cli/test/cli/bun-version-pin.test.ts so that bun.sha256 lists both assets, and the Dockerfile no longer pipes bun.sh/install into a shell.
4. Add a line to the RELEASING.md "Bun version" section: a bump updates packageManager and bun.sha256 together.

Acceptance criteria

• docker buildx build --platform linux/amd64,linux/arm64 of bun-node succeeds with the pinned checksums. It fails if one byte of either checksum is changed.
• bun --version in both images equals the packageManager version.
• The pin test covers both invariants in step 3.