ci: repair workflow pins and install smoke

[andrei-hasna]

Summary

Clean replacement for stale PR #206.

• updates 44 checkout pins to v7.0.0;
• updates 25 cache pins to v6.1.0;
• updates 3 pnpm setup pins to v6.0.9;
• adds Bun setup and strict npm/Bun clean-prefix install smoke coverage;
• preserves newer workflow changes from chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 #231/chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.1 #232/chore(deps): bump taiki-e/install-action from 2.81.11 to 2.82.10 #234 and excludes the already-landed state/BUILD.bazel hunk.

E2B validation

Exact head: 86e7d4a3466eef67d17210f5a244724cface70a7
Base: 96315fd0f2fa57622e299cfe06e7277e0d4154d6
Sandbox: eb932039-acc4-4fdc-8c4c-e963327779f9

• exact GitHub checkout and merge synthesis: PASS
• git diff --check: PASS
• staged/push/focused secret scans: PASS
• package-builder unit tests: 5 PASS
• npm/Bun clean-prefix install smoke: 2 PASS, registry-network smoke intentionally skipped
• Node 22 workspace install and TypeScript SDK build: PASS
• Prettier: PASS
• GitHub workflow-helper suite: 63 PASS
• pin-count assertions: checkout 44, cache 25, pnpm 3

Supersedes #206.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[andrei-hasna]

Provenance correction: exact head is now 77b9a14bb8a7baf247c6b8fbffef2a95f32efd05. This commit has the identical tree ee8ac015c0ebb7f852d9997c90452a5cde09395f and identical parent 96315fd0f2fa57622e299cfe06e7277e0d4154d6 as the previously validated head; only author/committer metadata changed to the linked GitHub identity Andrei Hasna <28298713+andrei-hasna@users.noreply.github.com> so CLA can evaluate it. E2B verified tree identity, zero content diff, clean merge onto current main 04eea4227c803cda7db8a694ab2b63c8b354fad7, and diff check PASS.

[andrei-hasna]

Adversarial review fix at exact head 86e7d4a3466eef67d17210f5a244724cface70a7: corrected the only three stale action-version comments in .github/workflows/v8-canary.yml (checkout v7.0.0 twice, cache v6.1.0 once). Action SHAs and behavior are unchanged. E2B verified the head delta is only that file, Prettier PASS, stale-comment assertions PASS, clean merge onto current main 04eea4227c803cda7db8a694ab2b63c8b354fad7, and diff check PASS. Full prior exact-tree package/smoke/workflow-helper evidence remains applicable.