chore: upgrade bun runtime to 1.4.2

[FNDEVVE]

Summary

Upgrades the pinned Bun runtime from 1.3.14 to 1.4.2 across CI workflows, package definitions, and the lockfile.

Changes

• Pi Network Tests: Bun 1.4 attaches an internal connection tracking listener (setupConnectionsTracking) to node:http.Server instances upon creation. Updated apps/pi-extension/server/network.test.ts to verify listener cleanup relative to the initial listener count (server.listenerCount("listening") === initialListening) rather than assuming zero absolute listeners.
• Root Dependencies & Lockfile:
  • Bump bun-types to ^1.4.2 in root package.json.
  • Bump @types/bun to ^1.4.2 in packages/ui/package.json so the declared range matches the runtime.
  • Add Bun 1.4.2 packages to minimumReleaseAgeExcludes in bunfig.toml.
  • Regenerate bun.lock with @types/bun@1.4.2, bun-types@1.4.2, bun@1.4.2, and @oven/bun-*@1.4.2 platform packages. The lock's previously stale @oven/bun-*/bun entries (a peer-dependency resolution of @plannotator/server's bun: >=1.0.0) are re-resolved against the registry; bun install --frozen-lockfile reports no changes.
• Workflows & Tooling:
  • Update bun-version: 1.4.2 across .github/workflows/{test,release,deploy,guides-show-deploy,security}.yml.
  • Update DAST configuration in .github/workflows/dast.yml with BUN_VERSION: 1.4.2 and TARGET_IMAGE: oven/bun:1.4.2-slim@sha256:cb3bbbb08e13a4a2ff400f24c7a2a1d5efa83f6ef8544d52d95a519631e2fc61 (index digest read from the registry; the same method reproduces the previously pinned 1.4.1-slim digest sha256:887d0f37… exactly).
  • Update Renovate setup-bun rule description in .github/renovate.json.
• Test Hardening:
  • Avoid race condition in waitForFile in packages/server/agent-terminal.test.ts by checking statSync(path).size > 0.
  • Add explicit finally config cleanup and 15s timeout to packages/server/api-404-guard.test.ts to prevent test timeout and state leakage under heavy test concurrency.
  • Give defaultRunCommand a 30s timeout in packages/server/uninstall.ts so the Windows PowerShell path does not trip under load.

Verification

All checks run locally under Bun 1.4.2 (macOS arm64):

• bun run typecheck: Passed (all 10 project tsconfigs emit zero diagnostics)
• bun run --cwd apps/guides-show build:viewer && bun run --cwd apps/guides-show sync:manifest && bun run --cwd apps/guides-show check:budgets && bun run --cwd apps/guides-show check:manifest: Passed (budgets within limit, worker import-free, manifest in sync)
• bun run --cwd apps/review build && bun run build:hook && bun run build:opencode: Passed
• Compiled binary check (bun build apps/hook/server/index.ts --compile): Successfully built and executed
• Full test suite (CI="" bun test): 4,346 passed, 912 skipped, 0 failed across 469 files (17,491 assertions)
• bun install --frozen-lockfile: Succeeded with no changes

[FNDEVVE]

Branch renamed to chore/upgrade-bun-1-4-2; GitHub cannot retarget a fork PR's head ref, so this PR was closed by that rename. Superseded by #1489, which carries the same commit.