ci: resolve the bun version from package.json in every workflow

Nine setup-bun steps had no version pinned, so they installed whatever
Bun was newest at run time: the whole of Code Quality (biome, typecheck,
claw-api-codegen, claw-api-contract, fallow), both Tests jobs, Audit, and
the Turbo cache warmer. Those are the workflows that gate merges, so a
Bun release could change install layout, resolution, or test behaviour
with no commit and no warning. It also let Tests pass on a Bun the
release workflows never use.

The remaining six hardcoded "1.3.6" in YAML, a third place to keep in
sync with what the repo already declares.

All fifteen now read the version from the existing source of truth:

  packageManager: "bun@1.3.6"

setup-bun's bun-version-file accepts package.json and prefers
packageManager, falling back to engines.bun. Both are present and agree,
so behaviour for the six release workflows is unchanged. Bumping Bun for
the entire repo is now a one-line change.

Every workflow was parsed to confirm valid YAML and that each setup-bun
step resolves from the file with no leftover literal: 15 steps, 0
problems.

Author: DaniAkash

.github/workflows/audit.yml

@@ -19,6 +19,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install dependencies
         run: bun ci

.github/workflows/build-browseros.yml

@@ -237,7 +237,7 @@ jobs:
         if: inputs.resource-mode == 'source' && inputs.product == 'browseros'
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.6"
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install BrowserOS server dependencies
         if: inputs.resource-mode == 'source' && inputs.product == 'browseros'

.github/workflows/code-quality.yml

@@ -26,6 +26,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       # Run Biome through the repo's own lint script (bunx @biomejs/biome) so CI
       # uses the exact same Biome as local `bun run lint`, instead of a version
@@ -52,6 +54,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Start Turbo remote cache (GitHub Actions cache)
         uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
@@ -89,6 +93,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Setup Biome
         uses: biomejs/setup-biome@v2
@@ -121,6 +127,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Setup Rust
         run: |
@@ -160,6 +168,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install dependencies
         run: bun ci

.github/workflows/release-claw-onboard.yml

@@ -226,7 +226,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.6"
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install browseros-agent dependencies
         working-directory: packages/browseros-agent

.github/workflows/release-cli.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.6"
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Validate release tag
         id: release

.github/workflows/release-extensions.yml

@@ -376,7 +376,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.6"
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Stamp in-repository extension version
         if: ${{ inputs.extension == 'agent' || inputs.extension == 'browserclaw' }}

.github/workflows/release-macos.yml

@@ -268,7 +268,7 @@ jobs:
         if: steps.inputs.outputs.resource_mode == 'source' && steps.inputs.outputs.products == 'browseros'
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.6"
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install BrowserOS server dependencies
         if: steps.inputs.outputs.resource_mode == 'source' && steps.inputs.outputs.products == 'browseros'

.github/workflows/release-server.yml

@@ -267,7 +267,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.3.6"
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install Wine
         run: |

.github/workflows/test.yml

@@ -52,6 +52,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Install dependencies
         run: bun ci
@@ -82,6 +84,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Setup Rust
         if: matrix.needs_rust == true

.github/workflows/turbo-cache-warm.yml

@@ -42,6 +42,8 @@ jobs:
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: packages/browseros-agent/package.json
 
       - name: Start Turbo remote cache (GitHub Actions cache)
         uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1