• add bun.lock and deno.lock to source control and pin exact devDependency versions, so CI installs are reproducible via --frozen #985