fix(build): bump pinned bun to 1.3.14 to repair macOS signing

[BlackHole1]

CI builds the release binaries with the bun version pinned in .bun-version, which was 1.3.13. That version's bun build --compile emits an invalid macOS code signature, so on Apple Silicon the kernel SIGKILLs the executable the instant it launches (exit 137) before any CLI code runs. Every published macOS binary — not just 1.4.0 but 1.3.0 too — therefore crashed on startup: oo --version, oo install, and the curl … | bash installer (whose install.sh runs oo install under set -euo pipefail) all aborted, while bun run index.ts stayed fine because dev never produces a compiled, signed binary.

Bumping the pin to 1.3.14 fixes it — that release repairs the bun build --compile binary-layout regression behind the broken signature. I confirmed the root cause by single-variable testing on one machine with identical flags: 1.3.13 reproduces the SIGKILL and 1.3.14 runs cleanly, independent of --bytecode/--minify (even a plain --compile fails on 1.3.13), and re-signing a 1.3.13 artifact with codesign -f -s - also recovers it. Rebuilding the darwin-arm64 binary through the real release script with the new pin produces a working oo.

Note this only fixes future builds — a re-publish is still required to replace the already-broken macOS binaries currently served from the CDN.

Follow-ups worth doing separately, so a regression like this can't ship silently again:

• Add a post-compile codesign -f -s - fallback for darwin targets in contrib/ci/npm-packages.ts, so a future bun signing regression is repaired in-pipeline.
• Add a native-macOS CI smoke test that runs oo --version on the compiled artifact — CI currently builds the binaries but never executes them, which is exactly why this shipped undetected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fbd0876a-9de8-4469-8460-2886db1f9472

📥 Commits

Reviewing files that changed from the base of the PR and between 2260840 and 2a11860.

📒 Files selected for processing (1)

• .bun-version

---

Summary by CodeRabbit

• Chores
  • Updated the Bun tool version used by the project to a newer patch release.

Walkthrough

This change updates the pinned Bun version in the .bun-version file from 1.3.13 to 1.3.14. No code, exported entities, or public interfaces are affected.

Related PRs: None identified.

Suggested labels: dependencies, chore

Suggested reviewers: None required for this trivial version bump.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows the required type(scope): subject format and accurately summarizes the Bun version bump.
Description check	✅ Passed	The description is directly related to the Bun pin update and explains the macOS signing fix.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/bun-macos-binary-signing

---

_{Comment @coderabbitai help to get the list of available commands.}