feat: run on Node or Bun — Bun is no longer an install prerequisite

[MyAlterLego]

The question was whether Bun could be shipped with the skill. It can — and it shouldn't, because it isn't necessary.

The toolkit's entire Bun dependency was four lines of dead code:

const f = Bun.file(path);                              // created
text = require("node:fs").readFileSync(path, "utf8");  // actually read via Node
void f;                                                // explicitly discarded

That was the only Bun.* call in Tools/ or the CLI. What remained binding the project to Bun was cosmetic: the shebangs, and the CLI hardcoding spawnSync("bun", …).

Why not vendor Bun

	cost
size	~34MB compressed per platform × 5 platforms in git, forever, including history
GitHub	warns >50MB, hard-blocks >100MB per file — needs Git LFS
supply chain	an unsigned runtime vendored inside a security-analysis toolkit — the disqualifying one

Download-on-first-use is smaller but breaks the promise the toolkit makes repeatedly: no API keys, no network calls, no telemetry, fully offline.

What this does instead

• Removes the dead Bun.file block — zero Bun APIs remain.
• stpa dispatches to process.execPath, so the child runtime always matches the parent. No PATH probing, no ambiguity about which runtime produced an analysis. Node <22.18 gets --experimental-strip-types automatically.
• stpa becomes CommonJS with a node shebang — it's the extensionless entry point, and Node only auto-detects ESM in extensionless files from 22.7 onward, so CJS is unambiguous on every Node ≥12. bun stpa still works and is still first-class.

Also fixes the new gates on the worked example

Examples/ledgerline is a design-document analysis, and two gates from #6 misbehaved on it:

• ControlInventory hard-failed for want of candidates.json. A Modality-B analysis has no code scan, so there is nothing to cross-check — passing is correct, not lenient. It still hard-fails a codebase analysis with no scan, which is the case where every absence claim is unfalsifiable. Verified both ways.
• The example now declares trustRoot on all six process-model variables, so it demonstrates the field instead of failing the gate that requires it.

Verification

With Bun genuinely removed from PATH, on Node v22.23:

./stpa --help via shebang        PASS
fixture grid                     PASS
worked example                   COVERAGE 100.0% (32/32), open 0
scope / controls / evidence / plan   all exit 0
full run chain                   exit 3 (NOT PEER-REVIEWED — correct for the example; main was also non-zero)
live 74-finding analysis         scope + controls + evidence + peer review all green

All five CI steps replicated locally under Node before pushing.

One honest limit: I have no genuine Bun in this environment, so I have not exercised the real Bun path — CI runs Bun and covers it there. I'm not claiming otherwise.