Label Bun transitive devDependencies via graph hydration

[zlav]

Overview

The Bun lockfile strategy never ran graph hydration, so a dependency reachable only transitively through a devDependency was labeled production and survived dev-dependency filtering. This adopts the label-direct-then-hydrate pattern the other Node strategies use.

Problem: BunLock.buildGraph set each package's environment by name-membership in the set of directly-declared devDependencies. A transitive dep not itself listed in any workspace's devDependencies fell through to EnvProduction and was not filtered.

Fix:

• Label only direct roots with their declared environment (dev → EnvDevelopment, prod/optional → EnvProduction); non-direct nodes carry no env label.
• Run hydrateDepEnvs so environments propagate to transitive successors. A dep reachable only via dev deps becomes EnvDevelopment; a dep also reachable from a prod dep keeps EnvProduction.
• No change to npm/git handling, workspaces, or graph shape.

Testing plan

• New fixture test/Bun/testdata/transitive-dev/bun.lock + specs: a transitive dep of a dev dep is EnvDevelopment (regression), a transitive dep of a prod dep stays EnvProduction, and a dep reachable from both roots keeps production.
• Updated the existing dependencies spec (semver via typescript is now dev, not prod).
• make test-cabal ARGS="Bun" → 42 examples, 0 failures.

References

• ANE-2836: Bun CLI strategy does not filter transitive devDependencies.
• Sibling ANE-2852 (pnpm lockfile v9) fixed the same class of bug via the label+hydrate approach mirrored here.

Checklist

• I added tests for this PR's change.
• I updated Changelog.md under an ## Unreleased section.