chore: refresh dependencies to latest and move CI to Bun 1.4.2 #33

Summary

Bring @code-yeongyu/pi-nested-agents-md to current dependencies and a Bun 1.4.2-based CI toolchain, review every open PR/issue, and cut a release so downstream consumers (senpi builtins / senpi install) can adopt it.

Current vs target

Dev dependencies (exact pins on the target):

Peer dependencies:

Runtime dependencies: refresh to latest, including majors when the test suite passes (e.g. vscode-jsonrpc 9, jsdom 30, undici 8, @ast-grep/cli 0.45) — each major called out in the PR body.

Toolchain / CI:

• Bun 1.4.2 as the primary dev + CI toolchain (oven-sh/setup-bun@v2, bun install --frozen-lockfile, bun run check, bun run test), plus one npm ci consumer smoke job — extension hosts install extensions with npm by default and peer resolution disabled, so package-lock.json stays and bun.lock is added.
• Node matrix 22 / 24; actions/checkout@v7, actions/setup-node@v7; engines.node >=22.19.0.
• No packageManager field (the package must stay installable by npm, bun and pnpm).

Open PRs to decide (merge after review / close with reason / request changes with file:line)

• chore(deps): bump @vitest/mocker and vitest #32 — chore(deps): bump @vitest/mocker and vitest (@app/dependabot)
• fix(deps): support pi 0.83 runtime #31 — fix(deps): support pi 0.83 runtime (@madgegja)
• chore(deps): bump actions/setup-node from 6 to 7 #30 — chore(deps): bump actions/setup-node from 6 to 7 (@app/dependabot)
• chore(deps-dev): bump the dev group across 1 directory with 5 updates #29 — chore(deps-dev): bump the dev group across 1 directory with 5 updates (@app/dependabot)
• chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 #27 — chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 (@app/dependabot)
• chore(deps): bump undici and @earendil-works/pi-coding-agent #26 — chore(deps): bump undici and @earendil-works/pi-coding-agent (@app/dependabot)
• chore(deps): bump actions/checkout from 6 to 7 #24 — chore(deps): bump actions/checkout from 6 to 7 (@app/dependabot)
• chore(deps): bump esbuild from 0.28.0 to 0.28.1 #18 — chore(deps): bump esbuild from 0.28.0 to 0.28.1 (@app/dependabot)

Dependabot PRs are superseded by the refresh PR and are closed after it merges, each with a comment naming the superseding PR.

Open issues to triage

• so this is omo for pi？ #13 — so this is omo for pi？

Acceptance criteria

• Refresh PR merged to main; CI on the merge commit is green on every matrix cell.
• bun run check and bun run test pass locally on Bun 1.4.2; npm ci && npm test passes as the consumer smoke.
• Every open PR listed above has a recorded decision; every open issue has a triage comment.
• CHANGELOG.md entry; version bumped; tag v<version> + GitHub release.
• Peer dependencies reference only @earendil-works/*.

Part of the 2026-09-24 pi-* extension cluster refresh (all sibling repos get the same treatment; senpi adopts the released versions afterwards).