Upgrade default Bun to 1.4.4
Merged
DA
1d ago+6+6+0123456789-8-8-0123456789
Upgrade the default Bun from 1.4.2 to 1.4.4, which includes the CA root refresh and compromised public-key rejection. Raise the minimum to 1.4.4 so existing managed Bun installations also upgrade.
Validation: 17 existing focused installer/runtime tests passed; changed-file Ruff/format and diff checks passed. Bun 1.4.4 completed the legitimate TLS control and rejected all 12 compromised test endpoints with CERT_REVOKED.