[wctiger]

Summary

• replace the npm-based Pages workflow with pinned Bun 1.3.14 installs
• run lockfile validation, Oxlint, and the Vite production build for pull requests
• keep Pages artifact upload and deployment restricted to main
• update the GitHub-maintained actions to their current major releases
• split validation/build from the least-privilege deployment job

Verification

• bun install --frozen-lockfile
• Oxlint passes with the committed configuration
• bun run build
• workflow YAML syntax validation