ci: install with npm, not bun — fix the v0.7.0 release build

The release build failed at "Install deps": bun --frozen-lockfile saw a
bun.lock that still pinned aimux 0.17.0 while package.json now asks ^0.19.0.
The project is npm-canonical (README installs via npm); bun is only needed to
compile the self-contained binary. So:

- install with `npm ci` (root + web), add setup-node 22; keep `bun build
  --compile` as the only bun step.
- package-lock.json referenced aimux as `file:../aimux` (a local dev link that
  can't resolve in CI) — repoint it to the published npm @digital-threads/aimux
  0.19.0.
- drop the now-unused bun.lock files.

Claude-Session: https://claude.ai/code/session_012GujqUM9Rzsu9dmhee8fQy

Author: shahinyanm

.github/workflows/release.yml

@@ -24,17 +24,22 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: oven-sh/setup-bun@v2 # only for the --compile step below
       - name: Install deps
-        run: bun install --frozen-lockfile
+        run: npm ci
       - name: Install web deps
-        # web/ is a separate package (own package.json + bun.lock) — its deps
+        # web/ is a separate package (own package.json + lockfile) — its deps
         # (react/vite + @testing-library, which the build's tsc type-checks)
         # aren't pulled by the root install, so install them too.
-        run: cd web && bun install --frozen-lockfile
+        run: cd web && npm ci
       - name: Build (host dist + web/dist)
-        run: bun run build
+        run: npm run build
       - name: Compile self-contained binary
+        # bun is the ONLY tool that compiles a self-contained executable; the
+        # install/build above are npm — bun is just the bundler here.
         run: bun build dist/cli.js --compile --outfile "release/loom${{ matrix.ext }}"
       - name: Stage web/dist next to the binary
         shell: bash