fix npm stage action policy

[alixander]

Summary

• remove the third-party setup-bun action rejected by the repository Actions policy
• install the exact tested Bun 1.3.14 package alongside npm 12.0.2
• keep the workflow limited to GitHub-owned actions

Verification

• the failed run created zero jobs and npm was never contacted
• repository Actions policy allows GitHub-owned actions only
• workflow now references only actions/checkout, actions/setup-go, and actions/setup-node
• YAML parses and git diff --check passes
• npm registry contains exact bun@1.3.14 and npm@12.0.2 versions

Nothing was staged or published by the failed run.