The Dockerfile pins Bun to an exact patch release, and a test refuses a floating tag #3803

Split from #3726. Production crashed on Bun 1.3.14 (#3708), and Dockerfile says FROM oven/bun:1.3-debian, a tag that floats to whatever patch release Bun ships next. A rebuild can therefore change the runtime with nobody choosing it. Decoding the crash needs a person (#3726's other half). This half needs no network.

Done:

• [ ] Dockerfile names an exact patch release: FROM oven/bun:1.3.14-debian, the release production runs today, so this pull changes nothing at runtime. A comment above the line says the version is chosen, not floated, and points at the decode issue for whether to move.
• [ ] A test (e.g. test/dockerfile-pin.test.ts) reads Dockerfile and fails on a FROM oven/bun: tag that is not MAJOR.MINOR.PATCH, so a floating tag cannot come back unnoticed.
• [ ] docs/RECOVERY.md (or the README's running section) says in two sentences how to move Bun: change the one line, run the check, watch the first hour of /system.

Files: Dockerfile, test/dockerfile-pin.test.ts (new), docs/RECOVERY.md. Risk: none at runtime; the image is the same release as today.

Parked by the crew: the check failed ("the doc fits two printed sides") and the decider saw no point in another try (pull #3807 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.