Make npm and bun scaffolds resolve consistent package versions (#682 follow-up)

[vivek7405]

Problem

After #682 (bun create skips install by default), the two scaffold paths can resolve DIFFERENT dependency versions for the same template:

• Bun (bun create webjs / --runtime bun, skip-install): no node_modules, so bun run dev auto-installs each dep at its absolute latest version. The package.json semver range AND any bun.lock are IGNORED at runtime (only an exact package.json pin holds, via the feat: pin Bun zero-install deps via an onLoad specifier-rewrite from package.json #685 onLoad rewrite), empirically confirmed in research: respect full package.json (ranges + tree) under Bun zero-install (default auto-install) #690.
• npm / Node (npm create webjs / --runtime node, install-by-default): npm install resolves the package.json ^ ranges to the latest-in-range version and pins the whole tree in package-lock.json.

So a fresh bun create webjs my-app and npm create webjs my-app of the same template can run different versions of @webjsdev/*, drizzle-orm, etc. The divergence is small at t=0 (latest equals latest-in-range when no out-of-range release exists) but GROWS once a dependency publishes a version outside the scaffold's range. Example: @webjsdev/core is pre-1.0, so once 0.8.0 ships, npm stays on 0.7.x (within ^0.7.0) while Bun jumps to 0.8.0.

The scaffold experience should be consistent across runtimes, especially the package versions an app actually runs.

Design / approach (decide, then implement)

Candidate directions:

1. Exact-pin the scaffold's package.json (the CLI knows the exact current versions at create time). Then BOTH runtimes resolve identical versions: Bun honors exact pins via the feat: pin Bun zero-install deps via an onLoad specifier-rewrite from package.json #685 rewrite, npm installs the exact versions. Most consistent and reproducible. Tradeoff: no automatic patch/minor bumps until the user loosens to ^ (reasonable for a starting point, and a fresh webjs create always emits the current versions anyway).
2. Accept and document the difference (Bun is an absolute-latest dev convenience, npm is latest-in-range pinned) as a deliberate per-runtime tradeoff, no code change. Cheapest, but leaves real divergence.
3. Other alignment (for example a committed lockfile plus a runtime strategy). Note that a bun.lock does NOT pin under Bun zero-install (research: respect full package.json (ranges + tree) under Bun zero-install (default auto-install) #690), so a lockfile alone cannot align Bun.

Recommendation to evaluate: option 1 (exact pins) gives the strongest consistency and is the only thing that makes Bun zero-install pin at all (#690 showed only exact pins hold). The owner previously accepted absolute-latest for Bun dev (#682), so the decision is whether cross-runtime CONSISTENCY is worth switching the templates to exact pins.

Implementation notes (for the implementing agent)

• Where: scaffold package.json generation in packages/cli/lib/create.js (the dep specifiers it writes); the per-runtime install default resolveCreateInstall() (bun create defaults to no install (zero-install onboarding); node unchanged #682); the research: respect full package.json (ranges + tree) under Bun zero-install (default auto-install) #690 zero-install behavior (exact pins only).
• If going with exact pins: emit the CLI's current @webjsdev/* version plus the known-good drizzle-orm and other dep versions as EXACT (no ^). Keep them in sync on each cli release (the changelog/release flow already bumps versions).
• Landmines: a bun.lock does NOT make Bun zero-install pin (ignored at runtime, research: respect full package.json (ranges + tree) under Bun zero-install (default auto-install) #690), so do not rely on committing a lock to align Bun. Node's package-lock.json DOES pin (npm install). The feat: pin Bun zero-install deps via an onLoad specifier-rewrite from package.json #685 rewrite only pins EXACT package.json pins under Bun zero-install.
• Tests + docs: a test asserting both scaffold paths resolve consistent versions for the same template (or a documented, asserted difference); update the runtime docs + scaffold AGENTS if the version strategy changes.

Acceptance criteria

• A fresh bun create and npm create of the same template resolve CONSISTENT dependency versions (or the difference is a deliberate, documented, tested decision).
• The chosen strategy is reflected in the scaffold package.json generation and the runtime docs.
• Cross-references bun create defaults to no install (zero-install onboarding); node unchanged #682 (skip-install default), feat: pin Bun zero-install deps via an onLoad specifier-rewrite from package.json #685 (exact-pin rewrite), research: respect full package.json (ranges + tree) under Bun zero-install (default auto-install) #690 (zero-install resolves latest), Zero-install dev/start on Bun via native auto-install (carve from #669) #675 (zero-install bootstrap).