docs: make the bun auto-install pin shim self-documenting + deletable

[vivek7405]

Problem

webjs carries a body of code that exists ONLY to work around bun's auto-install ignoring package.json (it fetches latest for bare imports). That includes the onLoad version-rewrite (#685/#698 bun-pin-rewrite.js, action-seed-bun.js installBunSeedPlugin pinTransform), the cli @webjsdev import retry (#709 import-webjsdev.js), the spawn-tool preload (#704 bun-pin-preload.js), the importmap version fallback (#699 declaredVendorVersions), and the scaffold ranges / banner (#700). All of it is a SHIM: the day bun's runtime honors package.json / bun.lock natively, every line should be removable. Today that removability is implicit knowledge, not documented, so a future agent cannot safely identify and delete the whole shim.

Design / approach

Make the shim self-documenting and centrally tracked so a future agent can remove it confidently when bun closes the gap:

1. A single canonical doc (e.g. agent-docs/bun-autoinstall-shim.md) that: states WHY the shim exists (bun auto-install ignores package.json, with the empirical evidence and the bun source comment and any upstream bun issue link), ENUMERATES every file / function / flag in the shim with its issue number, describes the capability-probe removal test (when bun run honors package.json / bun.lock natively, the shim is obsolete), and gives the exact deletion checklist.
2. A consistent code marker (e.g. a WEBJS-BUN-SHIM(#NNN) comment tag) on every shim site so grep WEBJS-BUN-SHIM enumerates the whole surface.
3. Cross-link from AGENTS.md and agent-docs/runtime.md.

Implementation notes (for the implementing agent)

• Shim sites to enumerate (grounded): packages/server/src/bun-pin-rewrite.js (resolveDepVersions / rewriteDepSpecifiers / isInlineableVersion, feat: pin Bun zero-install deps via an onLoad specifier-rewrite from package.json #685/feat: forward inline-safe ranges in the bun zero-install pin rewrite #698/bun-pin-rewrite: don't forward a caret-prerelease range (bun ENOENTs on it) #703), packages/server/src/bun-pin-preload.js (Make webjs db/test/typecheck work under bun zero-install (auto-install, no bun install) #704), packages/server/src/action-seed-bun.js (the installBunSeedPlugin pinTransform branch, feat: forward inline-safe ranges in the bun zero-install pin rewrite #698), packages/cli/lib/import-webjsdev.js (dogfood: bun zero-install bun run dev fails, cli can't resolve @webjsdev/server #709), packages/cli/bin/webjs.js (the importWebjsdev call sites, dogfood: bun zero-install bun run dev fails, cli can't resolve @webjsdev/server #709), packages/server/src/vendor.js (declaredVendorVersions plus the zero-install importmap fallback, Make the bun zero-install importmap share the server's resolved dep versions #699), packages/cli/lib/create.js (SCAFFOLD_DEP_VERSIONS, webjsdevRange, the post-scaffold banner, Revert scaffold @webjsdev/* + drizzle exact pins to semver ranges (after #698) #700), the runtime-rewrite.js bun bits, and the webjs-bun.mjs bootstrap generation (Zero-install dev/start on Bun via native auto-install (carve from #669) #675).
• Landmine: NOT all of it is pure shim. The Bun.serve listener seam, the TS stripper (amaro), and the runtime-neutral seam are real Bun SUPPORT, not auto-install workarounds. The doc MUST separate "remove when bun fixes auto-install" (the pin shim) from "permanent bun support", so a future agent does not delete legitimate Bun support.
• Tie-in to resilience: this is the documentation half of the broader resilience hardening (the fail-open gap in bun-pin-preload.js where rewriteDepSpecifiers is not wrapped, a capability probe + self-disable, a WEBJS_BUN_PIN escape hatch, CI against bun canary). A sibling "harden bun-pin resilience" issue captures the code half; this issue is the docs + grep-marker + deletion-checklist half.
• This is the user's explicit directive: every auto-install change documented well enough that a future AI agent can get rid of all of it when bun fixes the gap.

Acceptance criteria

• A single canonical shim doc exists enumerating every shim site by file / function / issue, with the WHY, the empirical evidence, the removal / capability-probe test, and a deletion checklist.
• Every shim code site carries a greppable marker so grep enumerates the full surface.
• The doc explicitly distinguishes the removable pin-shim from permanent Bun support (the Bun.serve seam, the TS stripper).
• AGENTS.md and agent-docs/runtime.md cross-link it.

Relates to #685, #698, #699, #700, #703, #704, #709, and the resilience discussion.

[vivek7405]

Closing as obsolete: Bun zero-install was removed in #721 (merged #722, released cli 0.10.28 / server 0.8.39). Bun apps now install with bun install like Node, so the pin shim, auto-install tooling, lockfile-drift, and zero-install docs this issue concerns no longer exist. True zero-install with editor types is a possible future Deno track (#669).