ci(npm): pin oven-sh/setup-bun to a SHA (#62)

Resolves CodeQL actions/unpinned-tag (#76, #77) — both setup-bun steps now
use the same pinned commit (# v2) already used by ci.yml and
docker-build-push.yml.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cevheri

.github/workflows/npm-publish.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.9"
 
@@ -63,7 +63,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.9"