feat(bun): add support for bunfig.toml registry config

[dennisameling]

Changes

Renovate now reads the [install] registry configuration from bunfig.toml when it detects a Bun lock file, and applies the resolved registry to the npm dependencies of that lock file's package files.

This continues #39830 by @sebdanielsson, with their commits preserved, rebased onto main and finished off against Bun 1.4.2.

Review feedback from #39830 that is addressed here:

• The schema moved into schema.ts and is parsed with Toml.pipe(); the string | { url } union is normalized to a URL string by a schema transform instead of a hand-written normalizeBunfigConfig() function
• The registries are applied before the package file is pushed onto the result, so the changes cannot get lost through the object spread
• codeBlock and toMatchObject are used in the tests
• @RahulGautamSingh asked whether workspace packages with their own bunfig.toml are handled. They are not, because Bun does not handle them either: I verified against Bun 1.4.2 that bun install reads only the bunfig.toml next to the lock file, both when run from the workspace root and when run from inside a workspace member. Renovate now does the same, and no longer searches parent directories for the file.

Finalized on top of that:

• bunfig.toml is matched through managerFilePatterns, so the extract cache stays correct when only that file changes
• A scoped registry from .npmrc keeps precedence over the default registry from bunfig.toml. Bun merges the two files key by key, so without this a repository which sets a default registry in bunfig.toml and a scoped registry in .npmrc would have its scoped packages looked up in the wrong registry, which is a regression compared to today
• Registry values which are not HTTP(S) URLs (for example an unexpanded $NPM_REGISTRY) are ignored
• Credentials are stripped from the registry URL, so they do not end up in registryUrls, logs or pull request bodies. Registry authentication stays with hostRules, and Bun's own .npmrc auth still works during lock file updates because Renovate writes the host rules into .npmrc before running bun install

Context

• This closes an existing Issue, Closes: bun: support bunfig.toml for custom registry detection #24460

AI assistance disclosure

• Yes: substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).

The original commits by @sebdanielsson were created with GitHub Copilot (Claude Opus 4.5). The rebase, the review fixes and the follow-up commits were made with Claude Code (Claude Opus 5), reviewed by @dennisameling before pushing.

Use of AI in replying to PR comments

Who answers review comments:

• @dennisameling will read and reply directly.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation

Added a bunfig.toml section to the bun manager readme.

How I've tested my work (please select one)

• Both unit tests + ran on a real repository

Besides the unit tests, I ran Renovate (RENOVATE_PLATFORM=local) against a Bun workspace whose bunfig.toml and .npmrc point at local registries, and compared the requests Renovate makes with the requests bun install (1.4.2) makes for the same repository. Both send the same package to the same registry in every case: default registry, scoped registry, workspace member, bunfig.toml over .npmrc default, and .npmrc scope over bunfig.toml default.