Replace bun.lock with package-lock.json and add package.json#allowScripts for
esbuild and sharp, the two native packages whose install scripts npm 11 gates.
Update README, RUNBOOK, TODOS and CLAUDE.md to npm commands. CLAUDE.md also
claimed ./setup requires bun; it does not any more.
Verified: astro check 0 errors, 39 tests pass, 4 pages build, clean npm ci.
