chore(trigger): run tasks on the bun-1.4 runtime - #9481

Summary

• Run Trigger.dev tasks on runtime: 'bun-1.4' (Bun 1.4.4), matching the app, realtime, and db images, which already run on Bun 1.4.4
• Bump @trigger.dev/sdk, core, build and the CI trigger.dev CLI from 4.7.6 to 4.8.2, the first release with bun-1.4
• Add a nodeBinary() build extension: the bun-1.4 image ships no node, but the isolated-vm sandbox and the Oracle worker run as node child processes. It copies Node 24.22.1 from a digest-pinned node:24.22.1-bookworm-slim, the same version as docker/app.Dockerfile. Because the layer adds image instructions, Trigger.dev builds the install stage from this base too, so isolated-vm's install script runs against that Node. Deploy only; trigger dev uses the local node
• distrustCompromisedRoots() stays in init. Under Bun 1.4.4 the roots are already absent, so it does nothing; docs updated

Hold the merge until 2026-11-05 ~13:36 UTC. @trigger.dev/*@4.8.2 was published 2026-10-29, and bunfig.toml's 7-day minimumReleaseAge cool-down has not elapsed. CI still installs because the frozen-lockfile install does not re-check release age, so the hold is policy, not a CI failure. The gate is left as is.

Type of Change

• Chore

Testing

• Rendered the Containerfile with the pinned trigger.dev@4.8.2 generateContainerfile (bun-1.4 + this layer): base COPYs Node and checks its version; the install stage builds FROM base
• Built that same stage layout locally for linux/amd64 from triggerdotdev/bun:1.4-bookworm (the CLI's pinned digest), using bun install with the real externals (isolated-vm 6.2.0, sharp, @napi-rs/canvas, pdfjs-dist):
  • Bun 1.4.4 → spawn('node', ['--no-node-snapshot', …]) → Node v24.22.1, and isolated-vm evaluates 1+1 = 2
  • sharp renders a PNG, and @napi-rs/canvas and pdfjs-dist load under Bun
  • With the Node layer removed, the spawn fails, so the layer is required
• biome check on changed files; type-check, audits, and tests run in CI
• Post-merge: watch the first staging deploy and a function-block run on Trigger.dev staging

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)