chore(deps): refresh dependencies and move CI to Bun 1.4.2

[code-yeongyu]

Summary

Refresh @code-yeongyu/pi-rules to current dependencies and a Bun 1.4.2 CI toolchain. Also lands native .pi/rules / ~/.pi/rules discovery (Fixes #11) and records the contributor merges already on main.

Fixes #32

Version table (old to new)

package	old	new
@code-yeongyu/pi-rules	0.1.1	0.2.0 (minor: #31 monorepo walk + #11 .pi/rules)
@biomejs/biome	2.5.6	2.5.14 (exact)
vitest	^4.1.10	5.0.1 (major, exact)
typescript	^7.0.2	7.0.2 (exact)
@types/node	^26.1.2	26.6.2 (exact)
@typescript/native-preview	^7.0.0-dev.20260707.2	7.0.0-dev.20260707.2 (exact)
@earendil-works/pi-coding-agent (dev)	(peer only)	0.87.1 (exact)
@earendil-works/pi-tui (dev)	(peer only)	0.87.1 (exact)
picomatch	^4.0.2 (resolved 4.0.5)	^4.0.7
@types/picomatch	^4.0.0	^4.0.3
typebox	peer *	devDependency ^1.3.34 (no longer a peer)
peers @earendil-works/pi-*	*	* (unchanged; never ^0.87)
engines.node	>=22.19.0	>=22.19.0

Majors: vitest 4 to 5. No runtime-dependency majors. typebox dropped from peerDependencies (peers are @earendil-works/pi-* only).

CI

• Job test: matrix ubuntu-latest/macos-latest x node 22/24
• actions/checkout@v7, actions/setup-node@v7, oven-sh/setup-bun@v2 with bun-version: 1.4.2
• bun install --frozen-lockfile, bun run check, bun run test, bun run test:integration, npm pack --dry-run
• Job npm-consumer (ubuntu, node 22): npm ci then npm test
• publish.yml verifies with bun but still publishes via npm publish --access public --provenance
• Both lockfiles committed (bun.lock + package-lock.json). No packageManager field.

PR decisions

number	decision
#31 @tradem	MERGED (squash) — monorepo git-root walk; maintainer follow-up for macOS realpath + tests
#19 @lavi-kj	MERGED (squash, rebased) — terminate findProjectRoot at dirname stall
#30 dependabot picomatch	close after this merge (superseded)
#29 dependabot dev-deps	close after this merge (superseded)
#26 @madgegja pi 0.83 peers	close after this merge (superseded by 0.87.1 + * peers; ^0.83 would break date-versioned runtimes)
#17 dependabot setup-node 7	close after this merge (superseded)
#14 dependabot checkout 7	close after this merge (superseded)

Issues

• Why not add '.pi/rules' directory into RuleSource #11: implemented .pi/rules and ~/.pi/rules (same source-list pattern as .omo/rules).
• chore: refresh dependencies to latest and move CI to Bun 1.4.2 #32: this PR.

Local gates

• bun --version 1.4.2
• bun run check exit 0
• bun run test 281 passed
• bun run test:integration 47 passed
• npm ci && npm test 281 passed
• npm pack --dry-run ok

---

Summary by cubic

Refreshes @code-yeongyu/pi-rules dependencies, moves CI to Bun 1.4.2, and adds .pi/rules plus ~/.pi/rules rule discovery (fixes #11). Bumps the package to 0.2.0.

Dependency Changes

• vitest majors from 4 to 5; other dev deps are pinned to exact versions.
• typebox is now a devDependency instead of a peer.
• Both bun.lock and package-lock.json are committed for npm consumers.

CI and Tooling

• CI installs with bun install --frozen-lockfile, adds a separate npm-consumer job, and updates checkout/setup actions.
• Publish flow verifies with Bun but still publishes with npm publish --provenance.

^{Written for commit 8ff4cc6. Summary will update on new commits.}