fix(scripts): detect modern bun.lock, ignore stray root lockfiles

Bun switched its default lockfile from the binary bun.lockb to the
text-based bun.lock, but detectFromLockFile() only ever checked for
bun.lockb — a project using modern Bun would never be detected as
using Bun at all.

Added bun.lock as the primary lockfile with bun.lockb kept as a
recognized legacy alias, so either format is detected correctly.

Also ignore stray bun.lock/bun.lockb at the repo root: yarn is this
repo's canonical package manager (package.json "packageManager"), so
a lockfile from someone running `bun install` locally shouldn't get
picked up by git status.

tests/lib/package-manager.test.js

@@ -131,7 +131,7 @@ function runTests() {
   })) passed++;
   else failed++;
 
-  if (test('detects bun from bun.lockb', () => {
+  if (test('detects bun from bun.lockb (legacy binary lockfile)', () => {
     const testDir = createTestDir();
     try {
       fs.writeFileSync(path.join(testDir, 'bun.lockb'), '');
@@ -143,6 +143,18 @@ function runTests() {
   })) passed++;
   else failed++;
 
+  if (test('detects bun from bun.lock (modern text lockfile)', () => {
+    const testDir = createTestDir();
+    try {
+      fs.writeFileSync(path.join(testDir, 'bun.lock'), '');
+      const result = pm.detectFromLockFile(testDir);
+      assert.strictEqual(result, 'bun');
+    } finally {
+      cleanupTestDir(testDir);
+    }
+  })) passed++;
+  else failed++;
+
   if (test('returns null when no lock file exists', () => {
     const testDir = createTestDir();
     try {