ci: pin bun to repo packageManager (1.2.6) so frozen-lockfile is deterministic

The ct-forge runner installs latest bun (1.3.14); ci.yml previously used the
runner's ambient bun, which rejected the committed lockfile ('lockfile had
changes, but lockfile is frozen'). Install the pinned bun@1.2.6 (matches
package.json packageManager) and prepend to PATH before install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -35,6 +35,14 @@ jobs:
         with:
           fetch-depth: 1
 
+      # Pin bun to the repo's packageManager version so `--frozen-lockfile` is
+      # deterministic regardless of the (disposable, latest-bun) runner image.
+      # Without this, a newer ambient bun rejects the committed lockfile.
+      - name: Setup pinned bun (1.2.6)
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v1.2.6"
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+
       - name: Cache bun dependencies
         uses: actions/cache@v3
         with: