* fix: pin bun runtime config and improve log hygiene * snapshot all SENSITIVE_PATHS to .claude-pr/, not just .claude/