[joeblau]

Task 28 of the CI Speedup Tasks, chart part (from the audit based on Owen Gretzinger's "How I made our CI 20x faster"). The haptic part is a separate PR in bloxwap/haptic.

Technique: #6 setup and caching. CI installs with Bun instead of npm ci.

What changed

• In tests.yml, docs.yml and coverage.yml, npm ci becomes the pinned oven-sh/setup-bun (v2.2.0 SHA, Bun 1.4.2) with bun install --frozen-lockfile, and steps use bun run/bunx.
  • setup-node stays because scripts and node --test still need Node.
• Adds a bun.lock, generated from package-lock.json.
  • bunfig.toml sets linker = "hoisted" so existing scripts that resolve from the root node_modules behave as under npm.
  • trustedDependencies: ["@bloxwap/chart-docs"] keeps the docs postinstall (fumadocs-mdx).
• publish_npm.yml (trusted publishing) and package-lock.json are untouched.
• Bun's download cache stays on the minis' disk, with no remote cache. Adds the fork-PR guard to the coverage job. Runners stay [self-hosted, macOS, ARM64].

Estimated impact (estimate, not measured): npm ci about 3 s → about 1 s per job.

Validation: locally, bun install --frozen-lockfile, lint and coverage (1,897 tests, 100 % gate) pass. Codex also ran the docs build, typecheck and browser tests on Linux.

Note: keep bun.lock and package-lock.json both current while npm publish remains.