fix(package): disable unsafe Bun identifier minification

[xjdr-noumena]

Summary

• Disable Bun identifier minification for standalone release packages.
• Keep whitespace-only minification as the safe package profile.
• Upgrade the Bun version pin used by CI/release workflows and package metadata from 1.3.10 to 1.3.14.
• Add a package-smoke manifest guard so identifier minification cannot be re-enabled silently.
• Document the upstream Bun collision class and the package behavior in CHANGELOG.

Reproduction

• Clean worktree from origin/main: /tmp/ncode-oss-issue36-pathb
• Built current package with the existing minify profile.
• Confirmed compiled binary contains the issue JS minification error #36 collision string:
  • strings -a /tmp/ncode-issue36-pathb-before/ncode-0.1.0-linux-x64/ncode | rg 'const A = H4(H4)'
  • Result: const A = H4(H4)

Validation

• ruby YAML parse for .github/workflows/ci.yml and .github/workflows/release.yml
• git diff --check for touched files
• bun build/packageSmoke.mjs --build-mode external --target bun-linux-x64 --out-dir /tmp/ncode-issue36-pathb-after --keep-output
• Verified package manifest has compileOptions.minify.identifiers=false
• Verified the fixed compiled binary no longer contains the exact issue JS minification error #36 collision string

Fixes #36