chore: migrate package manager to bun

[jaeyunha]

Summary

• migrate JS workspace package management from pnpm to Bun 1.3.14
• replace pnpm workspace/lock config with root Bun workspaces and committed bun.lock
• update Makefile, CI, Dockerfiles, publish workflows/scripts, and docs to use Bun commands
• add a release tarball pack helper so CLI tarballs publish with SDK version dependencies instead of workspace:* ranges

Verification

• bun install --frozen-lockfile
• bun run lint
• make check (blocked at Go API build: go binary is not installed in this lane environment; TypeCheck and Lint passed before the Go step)
• TZ=Asia/Seoul bun run test --filter '!@exponential/web'
• bun run --filter @namuh-eng/expn-sdk build && bun run --filter @exponential/web build
• node scripts/pack-release-tarballs.mjs .release; CLI tarball package.json contains @namuh-eng/expn-sdk: 0.1.0
• docker build -f Dockerfile -t exponential-bun-root:issue-728 .
• docker build -f infra/docker/web.Dockerfile -t exponential-bun-web:issue-728 .

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5024ca1730

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use a valid Bun install invocation in compose

When the compose web service starts, this command always reaches bun install --frozen-lockfile=false. Bun's install help lists --frozen-lockfile as a valueless flag (Disallow changes to lockfile), and running the same invocation exits with The argument '--frozen-lockfile' does not take a value, so docker compose -f docker-compose.dev.yml up will keep restarting the web container before Next starts. Use bun install or another supported Bun flag combination here.

Useful? React with 👍 / 👎.

[jaeyunha]

Controller disposition for current head 5024ca173049a91034291ba6cfd92765ccda4bd5: validation blocked before merge.

Verified:

• GitHub CI is green for Go API, Node, and Web typecheck jobs.
• Diff scope matches the package-manager migration: Bun workspace/lockfile added, pnpm lock/workspace files removed.
• Controller reran make check after bun install --frozen-lockfile successfully.
• Controller reran env -u NEXT_PUBLIC_APP_URL make test successfully; the cron-level NEXT_PUBLIC_APP_URL=http://localhost:7015 caused two URL-prefix test failures, but the repo-default env path passed.
• Controller reran SDK build, web build, and release tarball packing; CLI tarball depends on @namuh-eng/expn-sdk: 0.1.0, not workspace:*.

Blocker: I could not independently reproduce the required Docker builds from this controller environment because /var/run/docker.sock is root:docker, the controller user is not in the docker group, and sudo requires interactive auth. Worker-reported Docker build success is useful evidence, but merge should wait for reproducible Docker-build evidence from CI or a docker-enabled controller environment.

[jaeyunha]

Controller refresh for current head 5024ca17: validation remains blocked; prior clean/mergeable evidence is stale after staging advanced.

Fresh evidence:

• GitHub now reports PR chore: migrate package manager to bun #741 as CONFLICTING against staging.
• Disposable merge simulation from refs/pull/741/head into current origin/staging reproduces conflicts in AGENTS.md, CLAUDE.md, CONTRIBUTING.md, package.json, and pnpm-lock.yaml.
• CI is still green at the PR head, but it is not merge-ready while conflicts remain.

Next: rebase/rebuild the package-manager migration on current origin/staging, preserve only the intended bun migration delta, rerun CI plus Docker-build verification/risk-acceptance gate.