chore: switch package manager from bun to pnpm

Switch the project's package manager from bun to pnpm while keeping bun
as the TS runner and test runner for now (incremental migration).

Changes:
- Set packageManager to pnpm@10.11.0
- Move patchedDependencies into pnpm config section
- Add onlyBuiltDependencies for esbuild build script approval
- Add @sentry/core and @clack/prompts as explicit devDependencies
  (were phantom deps hoisted by bun's flat node_modules)
- Generate pnpm-lock.yaml

All 6968 unit tests pass. One pre-existing test fragility
(sdk.run auth test) surfaces under pnpm's strict hoisting but
is unrelated to this change.

Author: BYK

.github/workflows/ci.yml

@@ -63,7 +63,7 @@ jobs:
               - 'docs/**'
               - 'plugins/**'
               - 'package.json'
-              - 'bun.lock'
+              - 'pnpm-lock.yaml'
               - '.github/workflows/ci.yml'
       - name: Compute build matrix
         id: targets
@@ -123,13 +123,14 @@ jobs:
           # merge SHA, always fetchable from the base repo with github.token).
           ref: ${{ steps.token.outcome == 'success' && (github.head_ref || github.ref_name) || '' }}
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Generate API Schema
         run: bun run generate:schema
       - name: Generate docs and skill files
@@ -175,13 +176,14 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - run: bun run generate:schema
       - run: bun run lint
       - run: bun run typecheck
@@ -201,13 +203,14 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Generate API Schema
         run: bun run generate:schema
       - name: Unit Tests
@@ -233,25 +236,16 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ matrix.os }}-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ matrix.os }}-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - name: Install dependencies
         if: steps.cache.outputs.cache-hit != 'true'
         shell: bash
-        run: |
-          # Retry logic for Windows Bun patch bug (ENOTEMPTY errors)
-          for i in 1 2 3; do
-            if bun install --frozen-lockfile; then
-              exit 0
-            fi
-            echo "Attempt $i failed, clearing Bun cache and retrying..."
-            bun pm cache rm 2>/dev/null || true
-          done
-          echo "All install attempts failed"
-          exit 1
+        run: pnpm install --frozen-lockfile
       - name: Set nightly version
         # Inject the nightly version (computed once in the changes job) into
         # package.json before the build so it gets baked into the binary.
@@ -628,13 +622,14 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Download Linux binary
         uses: actions/download-artifact@v8
         with:
@@ -664,16 +659,17 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Bundle
         env:
           # Environment-scoped (production) — see note in build-binary.
@@ -705,6 +701,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
       # Astro 6 requires Node >= 22.12. Pin an explicit version so the docs
       # build doesn't rely on whatever ships on the runner image.
       - uses: actions/setup-node@v6
@@ -714,9 +711,9 @@ jobs:
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
       - name: Get CLI version
         id: version
         run: echo "version=$(node -p 'require("./package.json").version')" >> "$GITHUB_OUTPUT"

.github/workflows/docs-preview.yml

@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
 
       # Astro 6 requires Node >= 22.12. Pin an explicit version so the docs
       # build doesn't rely on whatever ships on the runner image.
@@ -45,10 +46,10 @@ jobs:
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
 
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Get CLI version
         id: version

.github/workflows/eval-skill-fork.yml

@@ -37,14 +37,15 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
 
       - uses: actions/cache@v5
         id: cache
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('bun.lock', 'patches/**') }}
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', 'patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
-        run: bun install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Generate docs and skill files
         run: bun run generate:schema && bun run generate:docs