make build-bin: on macOS, build with bun's pinned release build (closes #251)

nixpkgs points its macOS bun at an ICU in the nix store, and bun build
--compile copied that reference into bin/quak, so nix-collect-garbage could
break the cron backup. script/build-bin now downloads bun 1.3.13's release
archive on macOS too, Intel (baseline) or Apple silicon, checks its SHA-256,
and compiles with it. Those builds load only /usr/lib libraries. nix-shell is
no longer used; any system without a bun release build stops with an error.
The hash check falls back to shasum where sha256sum is missing.

Model: opus-5-5

test/packaging/build-bin.test.ts

@@ -1,23 +1,22 @@
 // `script/build-bin` compiles `bin/quak`, the single binary that the README's
 // cron setup runs. bun compiles it from a copy of its own executable, so the
-// binary loads through the same C library as the bun that built it. nix's bun
-// loads through a C library in the nix store, which garbage collection can
-// delete. On Linux the script therefore downloads bun's own release build,
-// which loads through the system's C library.
+// binary loads the same libraries as the bun that built it. nix's bun loads
+// libraries from the nix store, which garbage collection can delete: on Linux
+// its C library, on macOS its ICU. The script therefore downloads bun's own
+// release build, which loads only the system's libraries.
 //
 // What the script promises, and why each test matters:
 //
-// - On Linux, each machine and C library that bun publishes a build for gets
-//   its own archive: x86-64 or arm64, with glibc or with musl, as on Alpine. A
-//   bun built for another machine or C library does not start, and
-//   `make install` fails.
+// - Each system, machine and C library that bun publishes a build for gets its
+//   own archive: Linux on x86-64 or arm64, with glibc or with musl, as on
+//   Alpine, and macOS on Intel or Apple silicon. A bun built for another
+//   system, machine or C library does not start, and `make install` fails.
 // - The archive's SHA-256 must match the one in the script before anything in
 //   the archive runs. Without that check, a tampered download would build the
 //   binary that cron runs.
-// - Linux on any other machine stops with an error. Building there with nix's
-//   bun would bring back the dependency on the nix store.
-// - Other systems, such as macOS, compile with nix's bun as before, and
-//   download nothing.
+// - Any other system or machine stops with an error, and never falls back to
+//   nix's bun. Building with nix's bun would bring back the dependency on the
+//   nix store.
 //
 // Each test copies the script into a fresh directory, which the script then
 // treats as the checkout, and runs it there. Stubs first on PATH stand in for
@@ -140,41 +139,40 @@ describe("script/build-bin", () => {
     // The stub curl writes a file that is not the archive, so the hash check
     // must stop the script before unzip runs. A script without the check would
     // run unzip, and the stub bun it unpacks would write bin/quak.
+    // On macOS `uname -m` says arm64 on Apple silicon, where bun's archive
+    // says aarch64.
     it.each([
-        ["x86_64", "glibc", "bun-linux-x64-baseline.zip"],
-        ["x86_64", "musl", "bun-linux-x64-musl-baseline.zip"],
-        ["aarch64", "glibc", "bun-linux-aarch64.zip"],
-        ["aarch64", "musl", "bun-linux-aarch64-musl.zip"],
+        ["Linux", "x86_64", "glibc", "bun-linux-x64-baseline.zip"],
+        ["Linux", "x86_64", "musl", "bun-linux-x64-musl-baseline.zip"],
+        ["Linux", "aarch64", "glibc", "bun-linux-aarch64.zip"],
+        ["Linux", "aarch64", "musl", "bun-linux-aarch64-musl.zip"],
+        ["Darwin", "x86_64", "glibc", "bun-darwin-x64-baseline.zip"],
+        ["Darwin", "arm64", "glibc", "bun-darwin-aarch64.zip"],
     ])(
-        "on Linux %s with %s, downloads %s and stops when its hash does not match",
-        (machine, libc, archive) => {
-            const result = runBuildBin("Linux", machine, libc);
+        "on %s %s with %s, downloads %s and stops when its hash does not match",
+        (system, machine, libc, archive) => {
+            const result = runBuildBin(system, machine, libc);
             expect(argumentsOf("curl")).toContain(
                 "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/" +
                     archive,
             );
             expect(result.status).not.toBe(0);
             expect(ran("unzip")).toBe(false);
+            expect(ran("nix-shell")).toBe(false);
             expect(existsSync(join(checkout, "bin/quak"))).toBe(false);
         },
     );
 
-    it("stops on a Linux machine that bun publishes no build for", () => {
-        const result = runBuildBin("Linux", "riscv64");
-        expect(result.status).not.toBe(0);
-        expect(ran("curl")).toBe(false);
-        expect(ran("nix-shell")).toBe(false);
-    });
-
-    it("compiles with nix's bun on macOS", () => {
-        const result = runBuildBin("Darwin", "arm64");
-        expect(result.status).toBe(0);
-        expect(ran("curl")).toBe(false);
-        expect(argumentsOf("nix-shell")).toEqual([
-            "-p",
-            "bun",
-            "--run",
-            "bun build dist/bin/quak.js --compile --outfile bin/quak",
-        ]);
-    });
+    it.each([
+        ["Linux", "riscv64"],
+        ["FreeBSD", "amd64"],
+    ])(
+        "stops on %s %s, which bun publishes no build for",
+        (system, machine) => {
+            const result = runBuildBin(system, machine);
+            expect(result.status).not.toBe(0);
+            expect(ran("curl")).toBe(false);
+            expect(ran("nix-shell")).toBe(false);
+        },
+    );
 });