chore: refresh dependencies to latest and move CI to Bun 1.4.2 #32

Summary

Bring @code-yeongyu/pi-rules to current dependencies and a Bun 1.4.2-based CI toolchain, review every open PR/issue, and cut a release so downstream consumers (senpi builtins / senpi install) can adopt it.

Current vs target

Dev dependencies (exact pins on the target):

Peer dependencies:

Runtime dependencies: refresh to latest, including majors when the test suite passes (e.g. vscode-jsonrpc 9, jsdom 30, undici 8, @ast-grep/cli 0.45) — each major called out in the PR body.

Toolchain / CI:

• Bun 1.4.2 as the primary dev + CI toolchain (oven-sh/setup-bun@v2, bun install --frozen-lockfile, bun run check, bun run test), plus one npm ci consumer smoke job — extension hosts install extensions with npm by default and peer resolution disabled, so package-lock.json stays and bun.lock is added.
• Node matrix 22 / 24; actions/checkout@v7, actions/setup-node@v7; engines.node >=22.19.0.
• No packageManager field (the package must stay installable by npm, bun and pnpm).

Open PRs to decide (merge after review / close with reason / request changes with file:line)

• feat(monorepo): widen dynamic rule walk to the git repository root #31 — feat(monorepo): widen dynamic rule walk to the git repository root (@tradem)
• chore(deps): bump picomatch from 4.0.5 to 4.0.7 #30 — chore(deps): bump picomatch from 4.0.5 to 4.0.7 (@app/dependabot)
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates #29 — chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates (@app/dependabot)
• fix(deps): support pi 0.83 runtime #26 — fix(deps): support pi 0.83 runtime (@madgegja)
• fix(rules): terminate findProjectRoot walk at non-cwd drive roots #19 — fix(rules): terminate findProjectRoot walk at non-cwd drive roots (@lavi-kj)
• chore(deps): bump actions/setup-node from 6 to 7 #17 — chore(deps): bump actions/setup-node from 6 to 7 (@app/dependabot)
• chore(deps): bump actions/checkout from 6 to 7 #14 — chore(deps): bump actions/checkout from 6 to 7 (@app/dependabot)

Dependabot PRs are superseded by the refresh PR and are closed after it merges, each with a comment naming the superseding PR.

Open issues to triage

• Why not add '.pi/rules' directory into RuleSource #11 — Why not add '.pi/rules' directory into RuleSource

Acceptance criteria

• Refresh PR merged to main; CI on the merge commit is green on every matrix cell.
• bun run check and bun run test pass locally on Bun 1.4.2; npm ci && npm test passes as the consumer smoke.
• Every open PR listed above has a recorded decision; every open issue has a triage comment.
• CHANGELOG.md entry; version bumped; tag v<version> + GitHub release.
• Peer dependencies reference only @earendil-works/*.

Part of the 2026-09-24 pi-* extension cluster refresh (all sibling repos get the same treatment; senpi adopts the released versions afterwards).