Fix caniuse-lite update for Bun

[LabinatorSolutions]

Fix caniuse-lite update for Bun

Problem

The Bun branch is a single updateWith call:

} else if (lock.mode === 'bun') {
  updateWith(print, 'bun update caniuse-lite baseline-browser-mapping')

bun update <name> only operates on direct dependencies. caniuse-lite is
almost always transitive, so instead of updating it, Bun adds it — and
baseline-browser-mapping — to package.json as new direct dependencies at the
latest version, and leaves every nested copy on the old one.

Two consequences:

1. package.json gains two dependencies the project never asked for, on
   every run. Every other branch avoids this: deno follows deno add with
   deno remove, pnpm passes --no-save, and the manual path follows its
   install with <pm> uninstall. Only the Bun branch adds without removing.
2. The stale copies are never updated. The tool prints
   caniuse-lite has been successfully updated while the version that actually
   resolves at runtime is unchanged.

Reproduction

Using this repository's own test/fixtures/update-bun (its lockfile pins
caniuse-lite@1.0.30001639), after running the current code:

$ bun pm ls --all | grep caniuse-lite
│   └── caniuse-lite@1.0.30001639
│   └── caniuse-lite@1.0.30001639
├── caniuse-lite@1.0.30001809     <- newly added direct dependency
│   └── caniuse-lite@1.0.30001639

$ cat package.json   # two dependencies that were not there before
"dependencies": {
  "baseline-browser-mapping": "^2.11.13",
  "caniuse-lite": "^1.0.30001809"
}

The three nested copies — the ones Node actually resolves — are untouched. The
existing test passes because it asserts bun pm ls contains the latest
version, which the newly added hoisted copy satisfies.

Why not --no-save

Bun's --no-save is not pnpm's. Bun documents it as "Don't update package.json
or save a lockfile", and it behaves that way — with --no-save, no lockfile
is written at all, so there is nothing left to update.

Fix

Apply a temporary overrides entry, run bun install, then restore
package.json byte for byte and install once more. The override reaches nested
copies, and the resolutions survive its removal because the new version still
satisfies the parents' ranges.

Output becomes:

Latest version:     1.0.30001809
Updating caniuse-lite version
$ bun install (with a temporary caniuse-lite override)
Removing the temporary override
$ bun install
caniuse-lite has been successfully updated

package.json is restored in the failure path too, so an interrupted install
cannot leave an override behind.

Test

The existing Bun test is extended to assert what the old code got wrong:

• every caniuse-lite in the tree is at the latest version, nested copies
  included — not merely that one of them is;
• package.json is byte-identical to the fixture afterwards.

Verified it fails on the current code ((16 / 17), the Bun test failing) and
passes with the change (30 / 30 across the whole suite). oxlint and
Prettier are clean.

[ai]

Thanks. Released in 1.3.1.