fix: pin Bun to v1.3.11 to fix broken darwin-arm64 release binaries (#280)

Bun v1.3.12 introduced a regression (oven-sh/bun#29120) where
`bun build --compile` produces darwin-arm64 binaries with a truncated
code signature. macOS requires all arm64 binaries to be at least ad-hoc
signed, so the unsigned binary is immediately killed with SIGKILL
(exit 137).

Root cause: The Bun runtime binary grew by ~337KB in v1.3.12 (due to
Zig compiler changes), triggering a latent bug in `macho.zig`'s
`sig_size` calculation. The LC_CODE_SIGNATURE space allocated is too
small for the actual SuperBlob — 196,592 bytes allocated vs 537,138
bytes needed — resulting in a truncated, invalid signature.

Evidence:
- v4.1.2 (working): built with Bun v1.3.11 (CI run #24075809811)
- v4.1.3 (broken): built with Bun v1.3.12 (CI run #24285207021)
- v4.1.4 (broken): built with Bun v1.3.12 (CI run #24296958808)
- Locally confirmed: `codesign --remove-signature && codesign -s -`
  restores the binary to working state

Pin to v1.3.11 until the upstream fix lands.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kbwo

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: latest
+        bun-version: "1.3.11"
 
     - name: Install dependencies
       run: bun install

.github/workflows/npm-publish.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.11"
 
       - name: Setup Node.js (for npm publish)
         uses: actions/setup-node@v4