ci: install bun so tests/test-opencode-plugin.sh exercises the contract-injection wiring in CI

[thewrz]

This was written agentically; verify its assertions:

Problem

tests/test-opencode-plugin.sh runs the OpenCode plugin's wrapper (run-wrapper.mjs) and probe smoke test only when bun is on PATH; otherwise it prints a skip line and passes. The CI runner (ubuntu-24.04) does not install bun, so PR #388's entire injection wiring — caching, degradation, tag neutralisation, the watchdog fallback — is verified locally only while CI shows green.

Expected

ci.yml installs a pinned bun (SHA-pinned action or checksum-verified binary) before tests/run-tests.sh, and the suite's skip branch becomes a hard failure in CI (CI=true → missing bun fails).

Acceptance criteria

• CI log shows the 17 opencode-plugin assertions executing.
• Missing bun under CI=true fails the suite with a named reason.
• Action/binary pinned per security.md.

Non-goals

Running a real OpenCode session in CI.

North-star check

agent-kit is about fast, low token use, few turns, and scoped sub-agents; it is not about re-asking the operator for what the invocation already authorized. This issue is filed because the defect costs real root turns or a human round trip; the fix must not add a new one.

🤖 Co-authored by Claude Fable 5.