fix(ci): keep the macos builder on a literal bun pin

The macOS build job runs on the self-hosted builder against the
persistent tree at BROWSEROS_REPO_PATH and has no actions/checkout, so
GITHUB_WORKSPACE never holds the source. setup-bun resolves
bun-version-file from GITHUB_WORKSPACE, finds nothing, and falls back to
latest, which would have left source-mode macOS releases on a floating
toolchain.

Restore the literal pin for this one job and record why it cannot read
the version file. A job-level audit confirms it is the only one of the
fifteen setup-bun steps without a checkout ahead of it.

Author: DaniAkash

.github/workflows/release-macos.yml

@@ -266,9 +266,14 @@ jobs:
 
       - name: Setup Bun
         if: steps.inputs.outputs.resource_mode == 'source' && steps.inputs.outputs.products == 'browseros'
+        # Pinned literally rather than read from package.json: this job builds
+        # from the persistent tree at BROWSEROS_REPO_PATH and never checks out
+        # into GITHUB_WORKSPACE, which is where setup-bun resolves a version
+        # file from. A workspace-relative path finds nothing and Bun silently
+        # falls back to latest. Keep in sync with packageManager.
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version-file: packages/browseros-agent/package.json
+          bun-version: "1.3.6"
 
       - name: Install BrowserOS server dependencies
         if: steps.inputs.outputs.resource_mode == 'source' && steps.inputs.outputs.products == 'browseros'