Синхронизировать версию Bun builder с lockfile и закрепить policy frozen-lockfile

tools/build/README.md

@@ -55,7 +55,7 @@ Windows и macOS можно использовать для редактиров
 3. Устанавливает недостающие системные build dependencies через `apt-get`.
 4. Проверяет или скачивает локальные версии:
    - Go `1.21.13`;
-   - Bun `1.1.45`;
+   - Bun `1.3.13`;
    - Node.js `20.19.0`;
    - pnpm `9.15.9`.
 5. Собирает install-only orchestrator в standalone binary.
@@ -137,6 +137,24 @@ tar -tzf dist/hy2xs-install-0.1.6.tar.gz | grep -E '^(hy2xs-install/install.sh|h
 tar -xOzf dist/hy2xs-install-0.1.6.tar.gz hy2xs-install/metadata/package.env
 ```
 
+## When to update orchestrator/bun.lock
+
+Do not regenerate [`orchestrator/bun.lock`](../../orchestrator/bun.lock) during production builds.
+
+Update and commit [`orchestrator/bun.lock`](../../orchestrator/bun.lock) only when:
+
+- [`orchestrator/package.json`](../../orchestrator/package.json) changes;
+- `BUN_REQUIRED` changes in [`tools/build/lib/deps.sh`](lib/deps.sh);
+- orchestrator dependencies are intentionally upgraded.
+
+Production builder always runs:
+
+```bash
+bun install --frozen-lockfile
+```
+
+If this command fails, fix and commit the lockfile in source control. Do not remove `--frozen-lockfile`.
+
 ## Полезные переменные
 
 - `PACKAGE_VERSION=0.1.6`

tools/build/lib/deps.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 GO_REQUIRED="${GO_REQUIRED:-1.21.13}"
-BUN_REQUIRED="${BUN_REQUIRED:-1.1.45}"
+BUN_REQUIRED="${BUN_REQUIRED:-1.3.13}"
 NODE_REQUIRED="${NODE_REQUIRED:-20.19.0}"
 PNPM_REQUIRED="${PNPM_REQUIRED:-9.15.9}"
 TOOLCHAIN_DIR="${TOOLCHAIN_DIR:-$ROOT_DIR/.toolchain}"