make build-bin: on macOS, build with bun's pinned release build (closes #251)

nixpkgs points its macOS bun at an ICU in the nix store, and bun build
--compile copied that reference into bin/quak, so nix-collect-garbage could
break the cron backup. script/build-bin now downloads bun 1.3.13's release
archive on macOS too, Intel (baseline) or Apple silicon, checks its SHA-256,
and compiles with it. Those builds load only /usr/lib libraries. nix-shell is
no longer used; any system without a bun release build stops with an error.
The hash check falls back to shasum where sha256sum is missing.

Model: opus-5-5

README.md

@@ -156,10 +156,9 @@ requests. The "Library reference" below covers both.
 `quak backup` never prompts, so cron can run it. `make install` builds quak as
 one binary and copies it to `~/bin/quak`. It uses bun, a JavaScript runtime, to
 bundle the built `dist/` into one executable. Besides what Getting Started
-needs, `make install` needs `make`. On Linux it downloads bun from GitHub with
-`curl` and unpacks it with `unzip`. It checks the download against a SHA-256
-hash in the repo. On macOS it runs bun through `nix-shell -p bun`, so it needs
-[nix](https://nixos.org/download).
+needs, `make install` needs `make`. It downloads bun from GitHub with `curl` and
+unpacks it with `unzip`. It checks the download against a SHA-256 hash in the
+repo. `make install` works on Linux and macOS, on x86-64 and arm64.
 
 On Linux systems that use the musl C library, such as Alpine, `make install`
 downloads bun's musl build. On Alpine, both that bun and `~/bin/quak` need the
@@ -1937,11 +1936,9 @@ These apply to people and to coding agents alike.
     - container images by digest;
     - the nvm archive `script/bootstrap` downloads, and the Python packages
       `bin/clip-keyword-vectors` installs, by SHA-256 hash;
-    - bun's glibc and musl builds, which `script/build-bin` downloads on Linux,
-      by SHA-256 hash;
+    - the bun builds `script/build-bin` downloads, by SHA-256 hash;
     - Node and yarn, when `script/bootstrap` installs them, by version.
 - Not pinned:
-    - bun on macOS, which `script/build-bin` takes from `nix-shell -p bun`;
     - `make` and `git`, which `script/bootstrap` installs from the system
       package manager when they are missing, as every `Dockerfile` stage does;
     - `bash` and `curl`, which `script/bootstrap` installs the same way when it