Harden the shared Bun download cache against eviction and torn publishes

[arcaputo3]

Stack 6/N. Base is agent/bun-vendored-guard (#18), not main.

Why

An adversarial review pass over the stack found two ways the shared download cache introduced in
#14 could wedge or poison the now-default managed toolchain, plus three smaller sharp edges.

The bugs

An evicted cache was never repopulated. downloadedBunExecutable returned a plain PathRef
into the cache — Revalidate.Never — for a file that lives outside every Task.dest. Deleting
~/.cache/mill-bun (it is named and documented as a cache; evicting it is legitimate) left every
Mill run trusting a task result that points at a file that no longer exists. Nothing recovered
until the user guessed the right clean. The refs are now quick-signature (mtime + size)
Revalidate.Always, so recovery costs one stat per evaluation.

The cross-filesystem publish was not atomic. When the cache sits on a different filesystem
than out/ (a mounted CI cache volume; Docker with a bind-mounted workspace), the fallback was a
plain copy straight to the checksum-keyed final path. A concurrent reader could execute a
partially written binary, and a build killed mid-copy left a truncated file that every later build
trusts unconditionally — permanent poisoning, because existence at the path is the cache's proof
of validity. The fallback now copies to a temp name inside the cache directory and renames, so
the publish itself is always a same-filesystem atomic move. The copy also preserves file
attributes: the old os.copy.over silently dropped the executable bit.

Also fixed

• Losing a publish race is judged by the outcome (cached exists), not the exception type —
  Windows reports it as a sharing violation, not FileAlreadyExistsException.
• copyTree recreated relative symlinks as absolute paths into the source tree, so staged
  copies stopped being self-contained the moment the upstream task was cleaned. Raw link targets
  are now preserved verbatim (bun's node_modules/.bin entries are relative links).
• A relative MILL_BUN_CACHE_DIR resolved against nothing and crashed with a raw
  IllegalArgumentException; it now resolves against the workspace root.
• CI: the build job now sets MILL_BUN_USE_SYSTEM=true so the system-Bun path (findOnPath,
  version verification) keeps coverage after Pin Bun 1.4.0, compose the asset matrix, share the download cache #14 flipped the suite default to managed — that flip
  had made the job's setup-bun step install a binary nothing used. And pull_request CI is no
  longer restricted to PRs targeting main, so stacked PRs get checks.

Tests

Each fix was confirmed against the parent: the new test fails without the fix, passes with it.

• an evicted download cache is repopulated, not trusted (integration, forked evals with a
  private MILL_BUN_CACHE_DIR) — fails on the parent at exactly the reviewed scenario: the
  post-eviction eval succeeds while pointing at a file that no longer exists.
• relative symlink targets are preserved verbatim — fails on the parent (target absolutized).
• cross-filesystem publish preserves permissions and leaves no temp debris and
  … tolerates losing the race pin the new publish contract.

Known limits (unchanged, deliberate)

• musl detection can false-positive on a glibc distro that installs the musl compat package;
  the musl binary still runs there, and bunUseMusl is the documented override.
• prepareWebStage symlinks node_modules on Windows, which needs Developer Mode or admin;
  the Windows CI leg planned for this stack will tell us whether a junction fallback is needed.