E1: BROWSE SETUP install hint pins the tested Bun (1.4.0)

scripts/resolvers/browse.ts

@@ -133,7 +133,7 @@ If \`NEEDS_SETUP\`:
 3. If \`bun\` is not installed:
    \`\`\`bash
    if ! command -v bun >/dev/null 2>&1; then
-     BUN_VERSION="1.3.10"
+     BUN_VERSION="1.4.0"
      BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd"
      tmpfile=$(mktemp "\${TMPDIR:-/tmp}/bun-install.XXXXXX")
      curl -fsSL "https://bun.sh/install" -o "$tmpfile"

test/bun-version-drift.test.ts

@@ -142,6 +142,11 @@ describe('Bun requirement surfaces agree (E1)', () => {
     }
   });
 
+  test('BROWSE SETUP install hint pins the tested version', () => {
+    const resolver = fs.readFileSync(path.join(ROOT, 'scripts', 'resolvers', 'browse.ts'), 'utf-8');
+    expect([...resolver.matchAll(/BUN_VERSION="([0-9][^"]*)"/g)].map((m) => m[1])).toEqual([tested]);
+  });
+
   // Compiled probe of the security floor: a binary built with the four
   // no-autoload flags must not read a .env beside it. Run by hand against
   // released binaries on 2026-10-04: Bun 1.3.2 accepted the flags and still