policy: address review — drop the .ts contradiction, ban Deno, pin bunx

Review feedback from codacy-production and coderabbitai on the policy wave.
Three substantive points, all accepted:

1. ".ts CONTRADICTION" (codacy, MEDIUM, raised on most of the wave). The Bun row
   said "Executes .ts directly, no build step" in a file whose BANNED table bans
   TypeScript. OWNER RULING: TypeScript "should not exist at all", so advertising
   Bun's TypeScript capability is wrong regardless of whether it is true. Every
   .ts reference is removed from the row, including "JS/TS" in its label.
2. "DENO MISSING FROM BANNED" (codacy, raised repeatedly). The wave removed Deno
   from ALLOWED but never added it to BANNED, so the ruling was only half
   expressed. Added | Deno | Bun |.

3. "UNPINNED bunx" (coderabbitai, Security & Privacy). A bare `bunx <tool>` can
   fetch a package outside package.json/bun.lock, and can start Node via a
   shebang - both contrary to estate SHA-pinning doctrine and the Node ban.
   Guidance now requires a declared devDependency plus
   `bunx --no-install --bun <tool>`.

NOT taken: "a npm-compatible" (LanguageTool is wrong, "an" is correct before a
vowel sound); "--frozen-lockfile is redundant" (correct - no change needed, and
none made); the Nix->Guix point (real, but a separate ruling, deliberately not
folded into a Deno/Bun change).

Author: hyperpolymath

.claude/CLAUDE.md

@@ -24,7 +24,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
 | **AffineScript** | Primary application code | Affine-typed, compiles to typed-wasm or ESM |
-| **Bun** | JS/TS runtime & package management (tier 1) | Default for all new work. Executes `.ts` directly, no build step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
+| **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
@@ -42,6 +42,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | Banned | Replacement |
 |--------|-------------|
 | TypeScript | AffineScript |
+| Deno | Bun |
 | Node.js | Bun |
 | npm | Bun |
 | pnpm/yarn | Bun |
@@ -74,7 +75,7 @@ Both are FOSS with independent governance (no Big Tech).
 
 - **Primary**: Guix (guix.scm)
 - **Fallback**: Nix (flake.nix)
-- **JS deps**: Bun (`package.json` + `bun.lock`); `bunx <tool>` for one-off tooling
+- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements