Flip bun-mode scaffold Dockerfile to a pure oven/bun:1 base

[vivek7405]

Problem

--runtime bun scaffolds (#541) currently emit a Dockerfile with a node:24-alpine base plus a copied-in Bun binary, NOT a pure oven/bun:1 image. That workaround existed because a scaffolded app pins @webjsdev/cli: latest, and the boot-time webjs db migrate shelled npx drizzle-kit (no npx in a pure Bun image) until the npx-free CLI was published. @webjsdev/cli@0.10.20 (#570, runtime-native webjs db/test) is now the published latest, so a freshly scaffolded bun app resolves drizzle-kit and spawns it with the current runtime, no npx. The pure oven/bun:1 image is now safe and is the simpler, intended form.

Design / approach

Flip bunifyDockerfile back to the pure oven/bun:1 base (this is the original #541 design, deferred until the CLI shipped). The server already serves on Bun; with cli@0.10.20 the migrate runs under Bun without npx, so no Node toolchain is needed in the image.

Implementation notes (for the implementing agent)

• Where: packages/cli/lib/runtime-rewrite.js, bunifyDockerfile().
  • FROM node:24-alpine -> FROM oven/bun:1.
  • DROP the bun-binary copy (COPY --from=oven/bun:1-alpine /usr/local/bin/bun /usr/local/bin/bun); it is the base now.
  • The node template's RUN apk add --no-cache ca-certificates is alpine-only; oven/bun:1 is Debian (no apk, ca-certs already present), so REMOVE that line in the bun transform (do not leave an apk call that breaks the Debian build).
  • Keep COPY package.json bun.lock* ./ + RUN bun install + trustedDependencies (better-sqlite3 glibc prebuild fetches on the Debian base) + CMD ["bun", "--bun", "run", "start"].
  • Switch the healthcheck node -e -> bun -e (a pure Bun image: prefer bun; it also has a node shim, but bun -e is the honest form).
  • Rewrite the top comment + the CMD/bun-binary comments to the pure-oven/bun rationale (cli@0.10.20 makes db/test npx-free, so no Node base needed).
• Landmines: this reverses the Add a Bun-first scaffold mode (--runtime bun) across all 3 templates #541 "round-3 correction" that made it node-base; do not reintroduce the stale "webjs db migrate needs npx" rationale (that is fixed by Make webjs db/test commands runtime-native (Bun-safe, drop npx/node --test) #570). The change is safe ONLY because cli@0.10.20 is published latest; note that in the comment. Invariant 11 on all prose/comments.
• Tests: test/scaffolds/scaffold-runtime.test.js (assert FROM oven/bun:1, NO COPY --from=oven/bun:1-alpine, CMD ["bun","--bun","run","start"]) and packages/cli/test/runtime-rewrite/runtime-rewrite.test.mjs (the bunifyDockerfile unit case: oven/bun base, no node:24-alpine, bun -e healthcheck). Counterfactual already implicit (assertions flip).
• Docs: packages/cli/AGENTS.md (create-row + runtime-rewrite module entry -> pure oven/bun), docs/app/docs/getting-started/page.ts + docs/app/docs/deployment/page.ts (the scaffold now generates FROM oven/bun:1; the node-base+bun-binary becomes the "if you want a Node base" alternative). Root AGENTS.md scaffolding line.
• Dogfood: implement from a dedicated worktree (Enforce worktree-per-task to stop concurrent-agent branch collisions #590); run the scaffold + runtime-rewrite tests.

Acceptance criteria

• A --runtime bun scaffold emits FROM oven/bun:1 with bun install + CMD ["bun","--bun","run","start"] and NO node base / bun-binary copy / apk line.
• Healthcheck uses bun -e.
• Node mode is unchanged.
• runtime-rewrite + scaffold-runtime tests updated and green; docs (cli AGENTS, getting-started, deployment, root AGENTS) describe the pure oven/bun scaffold Dockerfile.