Greptile Summary

This PR fixes Bun-only projects silently installing unpatched packages by teaching the manifest model to parse top-level package.json#patchedDependencies and merging those entries into both the install-time patch loader and the patch-removal path.

• Adds bun_patched_dependencies() to PackageJson and merges it into load_patches / read_package_json_patched_dependencies with Bun entries having lowest precedence (overridden by pnpm/aube namespaced entries, which are in turn overridden by workspace-yaml).
• Adds remove_bun_patched_dependency so that patch-remove correctly clears top-level patchedDependencies from package.json, dropping the map when it becomes empty and guarding against spurious writes when the key was already absent.
• Extends the bun-messy-fixture bats smoke test with a runtime assertion and adds unit regression tests for load, remove, and BOM-prefixed files.

Confidence Score: 5/5

Safe to merge; the core load and removal logic is correct and well-covered by the new tests.

The removal function correctly guards the empty-map cleanup behind the removed flag, the *obj == before short-circuit prevents spurious writes, and both load_patches and read_package_json_patched_dependencies apply the same bun-then-pnpm merge order. The only issue is a misleading phrase in the module doc comment.

The module-level doc comment in crates/aube/src/patches.rs has a misleading precedence description worth correcting before merging if comment accuracy matters to the team.

Important Files Changed

_{Reviews (4): Last reviewed commit: "fix(bun): avoid stale patch removal rewr..." | Re-trigger Greptile}