chore: single package manager — bun owns this repo

- package-lock.json deleted; bun.lock is the only lockfile (CI already
  installs with bun install --frozen-lockfile).
- .npmrc sets package-lock=false so a stray npm install can't
  re-introduce a competing lockfile.
- Dead scripts removed: test:search / test:search:mcp pointed at
  scripts/ files that no longer exist; tsx devDependency dropped with
  them. Canonical test/lint/typecheck scripts added, matching CI.