ci: freeze bun lockfile and widen typescript path filter

Prevents silent bun.lock drift across CI runs (root cause of the
nightly fabro-spa staleness failure) and re-runs typescript.yml when
nightly.yml itself changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/nightly.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Install bun deps (for SPA verify)
         if: steps.skip.outputs.skip != 'true'
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Set up Rust
         if: steps.skip.outputs.skip != 'true'

.github/workflows/typescript.yml

@@ -12,6 +12,7 @@ on:
       - ".gitattributes"
       - "scripts/**"
       - ".github/workflows/typescript.yml"
+      - ".github/workflows/nightly.yml"
   pull_request:
     branches: [main]
     paths:
@@ -23,6 +24,7 @@ on:
       - ".gitattributes"
       - "scripts/**"
       - ".github/workflows/typescript.yml"
+      - ".github/workflows/nightly.yml"
   workflow_dispatch:
 
 concurrency:
@@ -42,7 +44,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      - run: bun install
+      - run: bun install --frozen-lockfile
       - run: cd apps/fabro-web && bun run typecheck
 
   test:
@@ -55,7 +57,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      - run: bun install
+      - run: bun install --frozen-lockfile
       - run: cd apps/fabro-web && bun test
 
   build:
@@ -68,7 +70,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      - run: bun install
+      - run: bun install --frozen-lockfile
       - run: scripts/refresh-fabro-spa.sh
       - run: git diff --exit-code -- lib/crates/fabro-spa/assets
       - run: scripts/check-fabro-spa-budgets.sh