docs(policy): ban ReScript explicitly and pin production installs (#726)

Adds ReScript to the BANNED table (canon bans it, destination AffineScript) and
puts --frozen-lockfile on Enforcement Rule 3, so a lockfile mismatch fails the
build instead of silently re-resolving.

The inserted row mirrors this file's own TypeScript replacement cell rather than
assuming the literal string "AffineScript", so bold, qualified and extra-column
table variants keep their existing wording instead of being flattened.

Enforcement Rule 1 is untouched: standards#655 records that collision as not
resolvable unilaterally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -49,7 +49,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
 | **AffineScript** (`.affine`) | Primary application code | Affine types, dependent types, row polymorphism, extensible effects; compiles to Wasm |
-| **Deno** | Runtime & package management | Replaces Node/npm/bun |
+| **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
@@ -74,12 +74,13 @@ The following files in `.machine_readable/` contain structured project metadata:
 | Banned | Replacement |
 |--------|-------------|
 | TypeScript | **AffineScript** |
+| ReScript | **AffineScript** |
 |  (new files) | **AffineScript** (migration via #488) |
 | JavaScript (where the project has been meaningfully migrated to AffineScript) | **AffineScript** |
-| Node.js | Deno |
-| npm | Deno |
-| Bun | Deno |
-| pnpm/yarn | Deno |
+| Deno | Bun |
+| Node.js | Bun |
+| npm | Bun |
+| pnpm/yarn | Bun |
 | Go | Rust |
 | Python (general) | **AffineScript** / Rust / Julia |
 | Java/Kotlin | Rust / Tauri / Dioxus |
@@ -102,9 +103,9 @@ Both are FOSS with independent governance (no Big Tech).
 ### Enforcement Rules
 
 1. **No new TypeScript files** - Write new code in AffineScript (closed exemptions table below covers the residual `.d.ts` / Deno-test cases).
-2. **No new  files** - As of 2026-05-25 policy refresh; AffineScript is the go-forward. Existing `.res` files stay until migrated via #488.
-3. **No package.json for runtime deps** - Use deno.json imports.
-4. **No node_modules in production** - Deno caches deps automatically.
+2. **No new ReScript files** - As of 2026-05-25 policy refresh; AffineScript is the go-forward. Existing `.res` files stay until migrated via #488.
+3. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
+4. **`bun install --production --frozen-lockfile` for production deps** - resolved from `package.json` and pinned via `bun.lock`; `--frozen-lockfile` makes a lockfile mismatch a build failure rather than a silent re-resolve
 5. **No Go code** - Use Rust instead.
 6. **Python only for SaltStack** - All other Python must be rewritten.
 7. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus.
@@ -164,7 +165,7 @@ Do not "migrate", rewrite, or delete `formal/*.v` as if it were V-lang.
 
 - **Primary**: Guix (guix.scm)
 - **Fallback**: Guix (flake.guix)
-- **JS deps**: Deno (deno.json imports)
+- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements