…and GO-2026-5037 (#127)

Add a new capture step "Bun Global Packages" that runs `bun pm ls -g`
and records installed bun globals in PackageSnapshot.Bun. The parser
strips tree-drawing characters and ignores the path header line; bun
itself and duplicates are filtered out.

PackageSnapshot.UnmarshalJSON handles bun across all three accepted
JSON shapes (structured object, rich object array, typed array), so
snapshots produced or consumed by other tools round-trip cleanly.

The server side (openbootdotdev/openboot.dev#14) accepts the new
`packages.bun` field and buckets bun globals into the existing npm
slot so the alias install endpoint installs them via `npm install -g`
from the same registry — no downstream changes required yet.