build(gstack): move from bun to npm

Replace bun.lock with package-lock.json and add package.json#allowScripts for
esbuild and sharp, the two native packages whose install scripts npm 11 gates.

Update README, RUNBOOK, TODOS and CLAUDE.md to npm commands. CLAUDE.md also
claimed ./setup requires bun; it does not any more.

Verified: astro check 0 errors, 39 tests pass, 4 pages build, clean npm ci.

gstack/.gitignore

@@ -10,7 +10,7 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 pnpm-debug.log*
-bun-debug.log*
+npm-debug.log*
 
 # environment variables
 .env

gstack/CLAUDE.md

@@ -13,7 +13,7 @@ git clone --single-branch --depth 1 https://github.com/garrytan/gstack.git ~/.cl
 cd ~/.claude/skills/gstack && ./setup
 ```
 
-`./setup` requires `bun` (`npm install -g bun` works) and a working Playwright Chromium (run `sudo npx playwright install-deps` if libs are missing on Linux).
+`./setup` requires a working Playwright Chromium (run `sudo npx playwright install-deps` if libs are missing on Linux).
 
 ### Web browsing
 

gstack/README.md

@@ -11,11 +11,11 @@ Scaffold only (v0.0.1.0). Modules are placeholders — landing page lists three
 ## Develop
 
 ```sh
-bun install
-bun run dev          # http://localhost:4321/try-gstack/
-bun run test         # Vitest (geom-engine unit tests)
-bun run typecheck    # Astro check + TS strict
-bun run build        # Static output to dist/
+npm install
+npm run dev          # http://localhost:4321/try-gstack/
+npm test         # Vitest (geom-engine unit tests)
+npm run typecheck    # Astro check + TS strict
+npm run build        # Static output to dist/
 ```
 
 ## Deploy

gstack/RUNBOOK.md

@@ -5,7 +5,7 @@
 Production deploys from `main` via GitHub Actions (`.github/workflows/deploy.yml`).
 
 - Live URL: `https://tiennm99.github.io/try-gstack/`
-- Build: `bun run build` (Astro static, output to `dist/`)
+- Build: `npm run build` (Astro static, output to `dist/`)
 - Deploy mechanism: `actions/upload-pages-artifact@v3` + `actions/deploy-pages@v4`
 - Concurrency: `pages-deploy` group, cancel-in-progress disabled (so a force-pushed retry doesn't abort an in-flight rollback)
 
@@ -23,7 +23,7 @@ If the workflow itself is broken (e.g., bad `deploy.yml` change), use the GitHub
 ## CI
 
 - `.github/workflows/ci.yml` runs typecheck + Vitest + build on every PR and push to `main`. Build failure on `main` blocks the deploy job.
-- Local equivalent: `bun install && bun run typecheck && bun run test && bun run build`
+- Local equivalent: `npm install && npm run typecheck && npm test && npm run build`
 
 ## Domain migration trigger
 

gstack/TODOS.md

@@ -93,7 +93,7 @@ Tracked work, organized by component then priority (P0 highest → P4 lowest). S
 
 - **Lighthouse-CI gate**
   **Priority:** P2
-  **What:** Mobile preset, ≥90 Perf + A11y. Run against `bun preview`.
+  **What:** Mobile preset, ≥90 Perf + A11y. Run against `npm run preview`.
 
 - **axe-playwright a11y tests**
   **Priority:** P2

gstack/package.json

@@ -24,5 +24,9 @@
     "@types/node": "^22.10.0",
     "typescript": "^5.7.0",
     "vitest": "^3.2.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "sharp": true
   }
 }