fix(ci): pin Bun for qa-cli-02

[vansin]

Outcome

Pins and verifies Bun for qa-cli-02-network-create, the unchanged L1 image that failed twice while PR #757 ran.

This is a narrow partial fix for #728. It does not close the remaining unpinned Dockerfile denominator.

Frozen coordinates

• base used by source: 43137f68fcc4f709e11ec39b8809cde6f527e6c3
• source: ae33b8688216cdbb462ce2ca3d56c73f4d703031
• report-only head: 69527dc9dd20d6945b6fa4b5b743c992067a690f
• current main at push: 05d4b73e9efe42421700e56e163164759a361eb0
• source delta: exactly tests/qa-cli-02-network-create/Dockerfile
• source → report delta: exactly docs/tests/report-qa-cli-02-pinned-bun.txt
• virtual merge against current main: no conflict markers

Why

The PR #757 L0/L1 job failed twice at the unchanged layer:

RUN curl -fsSL https://bun.sh/install | bash
exit code: 1

In each attempt every other L1 suite passed. Retrying did not make this member hermetic.

The replacement:

• pins Bun 1.3.14;
• uses the versioned GitHub release archive with three fail-closed retries;
• verifies upstream SHA256 951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f using sha256sum --check --strict;
• installs and checks both bun and the required bunx argv-0 symlink.

The checksum was independently read from Bun v1.3.14 SHASUMS256.txt, not copied only from another test.

Docker evidence

• image: sha256:3dc61c6bbe4bbb6729954a3c27573d532b161c06605d68e7918e14d0636b33bd
• archive verification: /tmp/bun-linux-x64.zip: OK
• complete qa-cli-02 lifecycle: PASS qa-cli-02 network-create
• runner log SHA256: 59cb0e146aa8a71e686f251516d2274d78174722d9dabdde015974f461544bd5
• witnessed red: all-zero checksum build exited 1 at sha256sum, reporting computed checksum did NOT match

The first archive-only diagnostic omitted bunx: the image built, but the real lifecycle failed at the anet preflight. The final source creates and version-checks bunx; the complete journey then passes.

Boundary

No package publication, release, production process/config/database, secret, or repository setting was changed. This PR remains Draft pending CI and independent review.

[vansin]

Superseded by Draft PR #762. The one-file fix proved qa-cli-02 itself: it passed in CI, after which the same unpinned installer failed immediately in qa-dash-07. That made clear a one-file candidate could never produce a stable L1 signal. #762 rebuilds from current main, covers the complete 14-suite L1 denominator with one shared pinned/checksummed installer, and passes all 14 journeys plus a wrong-checksum witnessed red. This PR remains as diagnostic history; it is not merged and no branch history is rewritten.