make build-bin: on macOS, build with bun's pinned release build (closes #251)

nixpkgs points its macOS bun at an ICU in the nix store, and bun build
--compile copied that reference into bin/quak, so nix-collect-garbage could
break the cron backup. script/build-bin now downloads bun 1.3.13's release
archive on macOS too, Intel (baseline) or Apple silicon, checks its SHA-256,
and compiles with it. Those builds load only /usr/lib libraries. nix-shell is
no longer used; any system without a bun release build stops with an error.
The hash check falls back to shasum where sha256sum is missing.

Model: opus-5-5

test/packaging/build-bin.test.ts

@@ -178,8 +178,7 @@ const argumentsOf = (command: string): string[] =>
 describe("script/build-bin", () => {
     // The stub curl writes a file that is not the archive, so the hash check
     // must stop the script before unzip runs. A script without the check would
-    // run unzip, and the stub bun it unpacks would write bin/quak. On Linux the
-    // check must use `sha256sum`, since a stock Alpine has no `shasum`.
+    // run unzip, and the stub bun it unpacks would write bin/quak.
     it.each([
         ["Linux", "x86_64", "glibc", "bun-linux-x64-baseline.zip"],
         ["Linux", "x86_64", "musl", "bun-linux-x64-musl-baseline.zip"],
@@ -193,7 +192,6 @@ describe("script/build-bin", () => {
                 "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/" +
                     archive,
             );
-            expect(ran("shasum")).toBe(false);
             expect(result.status).not.toBe(0);
             expect(ran("unzip")).toBe(false);
             expect(ran("nix-shell")).toBe(false);