fix: restore bun as the only package manager

[uzayer]

What happened

e10e7c8 ("landing page bump", 2026-08-08) was a 10-line edit to landing/index.html. It also ran yarn in the repo root:

 landing/index.html |   10 +-
 package.json       |    4 +-
 yarn.lock          | 5959 +++++++++++++++++++++++++++++++++++++++++

That committed a 5,959-line yarn.lock and stamped "packageManager": "yarn@1.22.22+sha512..." into package.json.

Nothing in this repo uses yarn. CI installs with bun install --frozen-lockfile, the tracked lockfile is bun.lock, and that field was the only reference to yarn anywhere outside the stray lockfile.

Why it matters beyond hygiene

Two JS lockfiles at root drifting independently is its own bug source. But it also broke Dependabot, which is what led me here.

Declaring yarn meant Dependabot couldn't resolve bun.lock. Every bun PR edited package.json without regenerating the lockfile and died at install in 8 seconds:

error: lockfile had changes, but lockfile is frozen

All six were dead on arrival — #104, #106, #109, #113, #122, #146.

The same missing resolution silently disabled the semver-major ignore. From dependabot-core's update_type_for_dependency:

prev_str = dep.previous_version&.to_s
curr_str = dep.version&.to_s
return nil unless prev_str && curr_str   # no resolved version → no classification

With no resolved lockfile version there is nothing to classify, so version-update:semver-major matched nothing and the ignore no-opped. That's why six majors came through the bun entry while all 38 Cargo PRs — which resolve against Cargo.lock normally — classified correctly and leaked zero.

One cause, both symptoms, with a clean control group.

The change

• Delete yarn.lock
• Remove the packageManager field

Removing rather than setting bun@1.3.14: this restores the state that demonstrably worked before e10e7c8 instead of introducing a value I can't verify. @testing-library/dom, the legitimate part of that commit, is untouched.

Verification

Run locally, not inferred from CI:

gate	result
bun install --frozen-lockfile	pass — Checked 971 installs across 1059 packages (no changes)
bun run lint	pass
bun run format:check	pass
bun run typecheck	pass
bun run test	pass — 476 tests, 12 files
bun run build	pass — built in 11.03s

no changes on the frozen install is the important one: bun.lock was already fully consistent with package.json, so nothing depended on yarn.

Follow-up

#151 disabled bun version updates (open-pull-requests-limit: 0) as a workaround, on the assumption the ignore failure was a Dependabot-side defect. It wasn't. Once a run confirms the ignore classifies correctly again, that can go back to 3 and JS updates resume properly.

I'd leave #151 in place until a live run proves it rather than reverting on theory — the mechanism is well-corroborated but untested end to end.