policy: address review — drop the .ts contradiction, ban Deno, pin bunx

Review feedback from codacy-production and coderabbitai on the policy wave.
Three substantive points, all accepted:

1. ".ts CONTRADICTION" (codacy, MEDIUM, raised on most of the wave). The Bun row
   said "Executes .ts directly, no build step" in a file whose BANNED table bans
   TypeScript. True of Bun, but it reads as licence to write new TypeScript.
   Reworded to compiled ESM/JS, with an explicit note that Bun's native .ts
   support does NOT license new TypeScript.

2. "DENO MISSING FROM BANNED" (codacy, raised repeatedly). The wave removed Deno
   from ALLOWED but never added it to BANNED, so the ruling was only half
   expressed. Added | Deno | Bun |.

3. "UNPINNED bunx" (coderabbitai, Security & Privacy). A bare `bunx <tool>` can
   fetch a package outside package.json/bun.lock, and can start Node via a
   shebang - both contrary to estate SHA-pinning doctrine and the Node ban.
   Guidance now requires a declared devDependency plus
   `bunx --no-install --bun <tool>`.

NOT taken: "a npm-compatible" (LanguageTool is wrong, "an" is correct before a
vowel sound); "--frozen-lockfile is redundant" (correct - no change needed, and
none made); the Nix->Guix point (real, but a separate ruling, deliberately not
folded into a Deno/Bun change).

Author: hyperpolymath

.claude/CLAUDE.md

@@ -21,7 +21,7 @@ project metadata (a2ml is TOML-flavoured, not Guile Scheme):
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
 | **AffineScript** | Primary application code | Compiles to JS/WASM, linear/affine type system |
-| **Bun** | JS/TS runtime & package management (tier 1) | Default for all new work. Executes `.ts` directly, no build step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
+| **Bun** | JS/TS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. Bun's native `.ts` execution does **not** license new TypeScript (see BANNED). |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
@@ -40,6 +40,7 @@ project metadata (a2ml is TOML-flavoured, not Guile Scheme):
 |--------|-------------|
 | TypeScript | AffineScript |
 | ReScript | AffineScript |
+| Deno | Bun |
 | Node.js | Bun |
 | npm | Bun |
 | pnpm/yarn | Bun |
@@ -74,7 +75,7 @@ Both are FOSS with independent governance (no Big Tech).
 
 - **Primary**: Guix (guix.scm)
 - **Fallback**: Guix (flake.guix)
-- **JS deps**: Bun (`package.json` + `bun.lock`); `bunx <tool>` for one-off tooling
+- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements