fix: pre-landing review fixes, pass 2 (GSTA-97)

- gstack-browser-ensure's failure line and the README tip suggest the
  frozen production install (./setup skips the install when the build is
  current, and a bare --production install is frozen anyway).
- setup install guard catches quoted and unquoted $BUN_CMD spellings.
- Replace the exact-text gstack-browser-ensure grep with an invariant: no
  full bun install; behavior is covered by gstack-browser-ensure.test.ts.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/gstack-browser-ensure.test.ts

@@ -179,7 +179,7 @@ describe('gstack-browser-ensure installs a missing node_modules production-only
     expect(r.status).toBe(1);
     expect(calls).toEqual(['install --production --frozen-lockfile', 'install --lockfile-only']);
     expect(lastLine(r.stdout)).toBe(`BROWSER_UNAVAILABLE bun install failed under ${f.root}`);
-    expect(r.stderr).toContain(`fix: cd ${f.root} && ./setup, then re-run`);
+    expect(r.stderr).toContain(`fix: cd ${f.root} && bun install --production --frozen-lockfile, then re-run`);
   });
 });