nix's bun loads through a glibc in the nix store, and bun build --compile
copied that loader into bin/quak, so nix-collect-garbage could break the
cron backup. The build moves into script/build-bin. On Linux it downloads
bun 1.3.13's release archive for x86-64 (baseline) or arm64 from GitHub,
checks its SHA-256 before running it, and compiles with that bun, so the
binary loads through the system loader. macOS still runs bun through
nix-shell.
Model: opus-5-5
