[julianknutsen]

Follow-up to the eMudhra CA compromise.

Change

• oven-sh/setup-bun bun-version 1.3.12 -> 1.4.4 in ci.yml and update-registry.yml. The production image runs oven/bun:1-alpine, which now resolves to Bun 1.4.4: the release whose bundled roots drop "emSign ECC Root CA - G3" and "AAA Certificate Services". CI now tests the runtime that ships.
• No lockfile change: bun audit is already clean on main after ci: clear the dependency audit and follow an upstream pack rename #613 (smol-toml, vite, brace-expansion, source-map-js).

Verification (local, Bun 1.4.4; same steps as the CI verify job)

• bun install --frozen-lockfile: OK. bun audit: no vulnerabilities (198 packages; the 5 @gascity/* skipped, since GitHub Packages has no audit endpoint).
• generate:check, typecheck, build, openapi:check: all pass, with no drift.
• bun run test:unit: 453 pass, 0 fail.
• Postgres tier (postgres:16-alpine, REGISTRY_TEST_REQUIRE_POSTGRES=1): store-conformance + publish-integration, 169 pass, 0 fail.
• Production image built with the gh_token secret. bun -e 'await import("./server/app.ts")' OK, reports Bun 1.4.4. gc pack release hash --help OK. check-ca-bundle: 0 affected roots. Base images came from mirror.gcr.io because Docker Hub was rate-limiting; the Dockerfile is unchanged.
• test:cli with the gc taken from that image: 1 pass. I ran it on port 49278, because 48278 was taken by an ephemeral outbound socket on my host.
• test:e2e (Playwright chromium): 33 passed.

After merge

• Rebuild and redeploy the registry image. oven/bun:1(-alpine) floats, so a fresh build picks up Bun 1.4.4 and Alpine's patched CA bundle.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}