build(gstack): move from bun to npm

Replace bun.lock with package-lock.json and add package.json#allowScripts for
esbuild and sharp, the two native packages whose install scripts npm 11 gates.

Update README, RUNBOOK, TODOS and CLAUDE.md to npm commands. CLAUDE.md also
claimed ./setup requires bun; it does not any more.

Verified: astro check 0 errors, 39 tests pass, 4 pages build, clean npm ci.

gstack/package.json

@@ -24,5 +24,9 @@
     "@types/node": "^22.10.0",
     "typescript": "^5.7.0",
     "vitest": "^3.2.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "sharp": true
   }
 }