#9338 chore(deps): upgrade Bun to 1.4.4

Summary

• Upgrade Bun 1.4.2 → 1.4.4: root packageManager, every workspace engines.bun floor, setup-bun in the shared setup action, checks, desktop-e2e, desktop-release, and helm workflows, and the oven/bun base images (1.4.4-slim for app, 1.4.4-alpine for db and realtime)
• Bun 1.4.4 carries oven-sh/bun#46159 (root store updated to NSS 3.131.1), so Bun's native fetch stops trusting emSign ECC Root CA - G3. Until now only node:tls honored the filter from @sim/security/tls-trust; Bun's fetch ignores tls.setDefaultCACertificates
• Bump the Pi sandbox Bun pin (PI_BUN_VERSION) to match; it takes effect on the next E2B/Daytona Pi image build
• @types/bun stays at 1.4.3: 1.4.4 was published less than a day ago and the minimumReleaseAge gate (7 days) blocks it. Types only, no runtime effect

Release notes reviewed for 1.4.3 and 1.4.4. Relevant changes: bun install now rejects unknown flags (every flag our workflows, Dockerfiles, and scripts pass is recognized), peer dependency resolution changes only apply to versions not already in bun.lock, and Linux installs now skip native optional packages built for the other libc

Type of Change

• Dependency update (security)

Testing

• bun install --frozen-lockfile with Bun 1.4.4: succeeds, bun.lock unchanged, patches apply
• Checked each bun install/bun add/bun pm/bunx flag we use against Bun 1.4.4's --help
• Confirmed oven/bun:1.4.4-slim and oven/bun:1.4.4-alpine exist for amd64 and arm64
• bun run lint; type-check, audits, tests, and image builds in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)