[lavaman131]

Moves Chopin from Bun 1.4.2 to Bun 1.4.4, which shipped today with security fixes for TLS, WebSocket, Bun.SQL, fetch, bun install and other APIs.

Where the version changed

• Workflows: ci.yml, release-cli.yml and verify-agents.yml (BUN_VERSION), and weekly-use-effect-review.md. Its .lock.yml was recompiled with gh aw compile 0.86.2, the compiler that produced it.
• mise.toml, and packageManager in package.json
• Dockerfile (ARG BUN_VERSION), e2e/conversation-plan.Dockerfile and e2e/design/Dockerfile (oven/bun:1.4.4; these images are pinned by tag, not by digest)
• AGENTS.md, README.md, docs/chopin-cli-reference.md (the Bun that /connector.js needs), docs/self-hosting.md, e2e/design/README.md
• bun.lock: the lockfile format is unchanged, so it was not regenerated. Only the @types/bun and bun-types entries and the new override changed.

@types/bun 1.4.4 isn't published yet. The catalog uses @types/bun 1.4.3, and an overrides entry pins bun-types to 1.4.4, the types published with this release. When @types/bun 1.4.4 is out, the override can be removed.

Changes in 1.4.3 and 1.4.4 that affected us

• Bun.SQL result types (1.4.4): a query result is now typed as T & ResultMetadata. Three toEqual checks in the migration test now compare a plain copy of each result.
• fetch network errors (1.4.4): the message now starts with the code, for example ECONNRESET: The socket connection was closed unexpectedly. Because of that, the connector printed Can't reach Chopin (ECONNRESET: ECONNRESET: …). failureCause now shows the code only once. This changes the connector.
• bun test .rejects and Bun.serve WebSockets (1.4.4 regression, oven-sh/bun#45805): while a .rejects matcher is pending, Bun.serve can close a valid socket with 1002 Received new message inside a fragmented message. I reproduced the upstream report on 1.4.4, and it passes on 1.4.2. The agent link's Stop and Resume test now awaits the refusal and then asserts on it. This only affects that test pattern. The frames on the wire are valid, and replaying them against a plain Bun.serve server works.
• ENETUNREACH in a route-free namespace: in a --network none container, Bun 1.4.4 still reports ENETUNREACH as ECONNREFUSED, the same as 1.4.2 (Node reports ENETUNREACH). The conversation-plan worker's version-keyed mapping now names 1.4.4.
• Also checked and not affected:
  • WebSocket close codes changed (1005 for close() without a code). Nothing in the app or connector depends on 1000.
  • bun install now rejects unknown flags. All of our flags are valid.
  • --disallow-code-generation-from-strings=strict has new behavior. We don't use it.
  • Bun.SQL no longer reads the PASSWORD environment variable. We pass the URL.

Connector / CLI

The chopin binaries are compiled with the release workflow's Bun, so the next CLI release will embed Bun 1.4.4 and include the failureCause fix. It needs a CLI release for users to get either one. This PR doesn't bump the CLI version.

Verification (Bun 1.4.4, run locally)

• bun install --frozen-lockfile: no changes
• GIT_CONFIG_GLOBAL=/dev/null bun test --parallel --no-isolate: 6725 pass, 22 skip, 0 fail. Before the fixes, the two failures above reproduced every time on 1.4.4 and never on 1.4.2. After the fixes, both files pass on both versions.
• bun run test:postgres against a disposable PostgreSQL 17: 121 pass
• bun run types and bun run ci: pass
• docker build . and docker build -f e2e/design/Dockerfile .: both build, and both images run Bun 1.4.4
• build:binaries bun-linux-x64: chopin 0.0.20, and the bridge smoke test apps/connector/src/binary.test.ts passes
• E2E against disposable databases: connector, connection, machines, planner-attachment, implementation-launcher, build-restart, collab and setup-agents. 60 passed, and 1 live-only test was skipped.

There's no UI change, so this PR has no visual preview.