CLI install should use the latest bun lockfile format and a `--frozen-lockfile` flag

[evan-gray]

Peeking further, the CLI install.sh uses bun install which is bad practice and probably outside the scope of this PR. the old bun.lockb should likely be removed and regenerated with a bun install --lockfile-only or migrated with bun install --save-text-lockfile --frozen-lockfile --lockfile-only and the install script modified to use bun install --frozen-lockfile. For more on bun lockfiles, see https://bun.com/docs/install/lockfile

Originally posted by @evan-gray in #702 (comment)