fix: bun.lockb → bun.lock + auth before manifest check

This project uses bun.lock (text format), not bun.lockb (binary).
Also move Docker login before manifest inspect so GHCR auth works.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/ci-image.yml

@@ -8,14 +8,14 @@ on:
     branches: [main]
     paths:
       - '.github/docker/Dockerfile.ci'
-      - 'bun.lockb'
+      - 'bun.lock'
       - 'package.json'
   # Build on PRs that change the image (so first PR run has it)
   pull_request:
     branches: [main]
     paths:
       - '.github/docker/Dockerfile.ci'
-      - 'bun.lockb'
+      - 'bun.lock'
       - 'package.json'
   # Manual trigger
   workflow_dispatch:
@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@v4
 
       # Copy lockfile + package.json into Docker build context
-      - run: cp bun.lockb package.json .github/docker/
+      - run: cp bun.lock package.json .github/docker/
 
       - uses: docker/login-action@v3
         with: