make build-bin: binary uses the system loader on Linux (closes #240)

nix's bun loads through a glibc in the nix store, and bun build --compile
copied that loader into ~/bin/quak, so nix-collect-garbage could break the
cron backup. On Linux x86-64 the build now passes
--target=bun-linux-x64-baseline, which makes bun use its downloaded release
build with the system loader. Other Linux architectures are refused, since
the fix is untested there; macOS is unchanged.

Model: opus-5-5

README.md

@@ -138,7 +138,10 @@ requests. The "Library reference" below covers both.
 one binary and copies it to `~/bin/quak`. Besides what Getting Started needs,
 `make install` needs `make` and [nix](https://nixos.org/download). It uses bun,
 a JavaScript runtime, to bundle the built `dist/` into one executable. It runs
-bun through `nix-shell -p bun`.
+bun through `nix-shell -p bun`. On Linux it works on x86-64 only. There, the
+binary is built from bun's own release build rather than nix's bun, so it does
+not need the nix store. The first build downloads that release build into
+`~/.bun`.
 
 Log in once with `~/bin/quak`, as the user the cron job will run as:
 
@@ -1910,7 +1913,8 @@ These apply to people and to coding agents alike.
       `bin/clip-keyword-vectors` installs, by SHA-256 hash;
     - Node and yarn, when `script/bootstrap` installs them, by version.
 - Not pinned:
-    - bun, which `make build-bin` takes from `nix-shell -p bun`;
+    - bun, which `make build-bin` takes from `nix-shell -p bun`, and on Linux
+      the release build of the same bun version that it downloads;
     - `make` and `git`, which `script/bootstrap` installs from the system
       package manager when they are missing, as every `Dockerfile` stage does;
     - `bash` and `curl`, which `script/bootstrap` installs the same way when it