#25035 bun 1.4.4 everywhere: devEngines and every setup-bun pin

Leo, 2026-10-24: "surely we can just update bun on everything? they're usually p good ab breaking/nonbreaking changes"

PR B of two. It is stacked on #25004 (PR A: bun checks become a minimum, and every setup-bun pin follows devEngines). Once A merges, this PR retargets to feat-cmux-next.

What changed

• webviews/package.json devEngines.packageManager.version moves from 1.4.2 to 1.4.4.
• All 103 oven-sh/setup-bun steps move to bun-version: "1.4.4". tests/test_ci_change_areas.py (from A) fails on any step that doesn't match devEngines.
• The P1 row in workers/cmux-actions/DESIGN.md now names 1.4.4.

Risk

• Every CI job moves from bun 1.4.2 to 1.4.4. Notable 1.4.4 changes:
  • An unknown install flag is now an error.
  • --frozen-lockfile is stricter: it fails on locked versions outside the package.json range or forbidden by overrides.
  • Coverage percentages change.
  • bun.lock gets new keys (libc, hasInstallScript).
• No lockfile is regenerated here. If CI shows a frozen-lockfile failure caused by the bump, that lockfile is regenerated on a fleet host in this PR.
• The hq build recipe refuses a bun it has no sha pins for, so this PR waits for hq#4102 (see the HOLD line).

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}