[vigneshrajsb]

Add bunfig.toml so bun install/bun add only resolve package versions published at least 3 days ago (minimumReleaseAge = 259200 seconds). This needs Bun ≥1.3, so packageManager, CI, deploy, and the Dockerfile move from Bun 1.2.8 to 1.4.3. The Dockerfile install now uses --frozen-lockfile. For an urgent fix, add the package name to minimumReleaseAgeExcludes.

Reader and task

• Audience: N/A
• Task/outcome: N/A

Source of truth

• Exact owning repository revisions, PR head SHAs, or immutable artifacts: N/A
• Frontmatter verification baseline added or reused: N/A
• Product or runtime verification: on Bun 1.4.3, bun install --frozen-lockfile installs with bun.lock unchanged; a probe bun add typescript@next resolved the 3-day-old nightly, not today's
• Contract checks (schema / OpenAPI / CLI; identify any SKIP): N/A
• Unavailable or unresolved sources: N/A

Documentation changes

• Changed pages: none, build tooling only
• ASD-STE100 human review: N/A
• Navigation or redirects: N/A
• Raw Markdown projection: N/A
• External state: sanitized authorization and cleanup assertion, with only
  public or non-sensitive references (keep private identifiers in task scratch): N/A
• Screenshots, catalog status, and manual pixel/state review: N/A

Verification

• Formatted changed files
• Kept source-review evidence and non-actionable implementation details out of end-user prose
• Confirmed that each changed sentence helps the reader understand, complete, verify, or recover the task
• Reviewed all 53 rule rows in .agents/skills/update-lifecycle-docs/references/ste100-review.md
• bun run check:styles
• Updated the style baseline only after the complete human review
• bun run check:raw
• bun run verify
• bun run check:contracts --require-all when schema, API, or CLI claims changed
• Checked changed routes with an approved desktop browser inspection tool
• Checked every theme enabled by the current theme config
• Ran bun run check:screenshots when visuals changed
• Confirmed screenshots contain no secrets or personal/private data
• Confirmed tracked guidance has no contributor-specific paths, hosts, credentials, or fixture identities