Phase 4: Replace bun run with tsx/pnpm run

Part of the Bun → Node.js migration. Removes Bun as the TypeScript runner for scripts and CI, replacing with tsx and pnpm run.

Changes

Script files (14 converted):

• Replaced Bun.file().text() → readFile() from node:fs/promises
• Replaced Bun.write() → writeFile()
• Replaced Bun.file().exists() → access()
• Replaced Bun.file().json() → JSON.parse(readFile())
• Replaced new Bun.Glob() → tinyglobby
• Updated shebangs: #!/usr/bin/env bun → #!/usr/bin/env tsx
• generate-api-schema.ts: replaced require.resolve("@sentry/api/package.json") with import.meta.resolve + fileURLToPath (avoids ERR_PACKAGE_PATH_NOT_EXPORTED and ERR_AMBIGUOUS_MODULE_SYNTAX)

ESM require shim (script/require-shim.mjs):

• Source code uses bare require() for lazy loading (circular dep breaking, optional features). This works natively in Bun and CJS bundles, but fails under tsx/Node ESM (since "type": "module" is set).
• The shim provides globalThis.require via createRequire, anchored at the project root (package.json).
• All relative require() calls in src/ are behind runtime-only code paths (DB init, telemetry) that do not execute during tsx script runs.

Worker source refactor (src/lib/scan/grep-worker-source.ts):

• Replaced import ... with { type: "text" } (Bun-specific) with a wrapper module that uses readFileSync at dev time.
• At build time, esbuild's text-import-plugin intercepts the module and inlines grep-worker.js as a string constant.
• Removed the now-dead textImportPlugin from vitest.config.ts.

package.json:

• Added "tsx" script alias: tsx --import ./script/require-shim.mjs
• All scripts use pnpm tsx (which invokes the alias)
• Only build/build:all retain bun run (needs Bun.build() compiler)

CI (.github/workflows/ci.yml):

• Removed setup-bun from all jobs except build-binary
• All bun run → pnpm run in non-build steps

Documentation:

• Updated README.md, DEVELOPMENT.md, contributing.md to use pnpm run instead of bun run
• Updated script JSDoc usage examples in bench.ts, bench-sweep.ts
• Added docs/pnpm-lock.yaml for docs site build (was using bun.lock)

Tests:

• Fixed bundle.test.ts and library.test.ts E2E tests: spawn("bun", ...) → spawn("pnpm", ...)
• Fixed concurrent-worker.ts shebang and usage comments

Intentionally kept on Bun

• script/build.ts — uses Bun.build() (compiler) which has no Node equivalent
• build-binary CI job retains setup-bun

Testing

• All CI checks pass (lint, typecheck, unit tests, E2E, build binary, build npm, build docs)
• tsx confirmed working on Node v22 and v24