Port Bun installer no-follow marker and bin chmod hardening

Current Bun adds two production hardening guarantees covered by test/cli/install/symlink-path-traversal.test.ts:

• buffered GitHub tarball extraction opens .bun-tag with O_NOFOLLOW before truncating/writing it
• package bin linking applies executable permissions without following a symlinked bin target

Home currently follows both final symlinks in the strict native child-process path, allowing an archive-provided .bun-tag chain to overwrite an outside file and allowing a workspace bin symlink to chmod an outside file.

Port the real installer behavior, preserve the unchanged Bun security fixture, and validate Debug/ReleaseSafe strict plus routed execution against pinned Bun.

Parent tracking: #66 Corpus rewrite tracking: #202

Completed in a6a7c4e38.

Production changes:

• buffered GitHub extraction now opens .bun-tag relative to the extraction directory with O_NOFOLLOW before truncating/writing
• package bin linking now applies the executable mode through a no-follow lchmod path and uses 0o777 & ~umask, matching current Bun
• Home exports the no-follow syscall wrapper through bun.sys

Validation against the unchanged, byte-identical current Bun fixture (56724a94e...):

• pinned Bun: 6 pass, 0 fail, 14 assertions
• Home Debug strict: 6 pass, 0 fail across four consecutive runs
• Home Debug routed: 6 pass, 0 fail across three consecutive runs
• combined Debug and ReleaseSafe strict: 49 pass, 0 fail, 1,457 assertions
• combined Debug and ReleaseSafe routed: 49 pass, 0 fail
• runtime units: 1,822 passed, 19 skipped, 0 failed

The fixture-specific using dir rewrite was removed separately in 078363fa4; the real production hardening now carries the security behavior.