fix: prevent Bun downgrades during upstream merges

[catrielmuller]

Summary

• Reconcile the root packageManager by keeping the newer valid Bun version from Kilo or upstream.
• Validate the merged result against the pristine base and upstream commits before finalization.
• Restore the repository's intended Bun 1.3.14 pin and cover downgrade, upgrade, malformed, and nested-package cases.

Upstream merges could previously overwrite a newer Kilo Bun pin with an older upstream value. The reconciliation now allows genuine upstream upgrades while preventing accidental runtime downgrades, including regressions caused by future transform or rerere behavior.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

All 4 previously flagged issues have been resolved in the new commits.

Previous Issue	Status
merge.ts: git show called without .nothrow()	✅ Fixed — extracted into managerAt helper with .nothrow() and graceful warning
transform-package-json.ts: Dead code compareVersions(match[1], match[1])	✅ Fixed — line removed
transform-package-json.ts: Tie-breaking always picked upstream on equal versions	✅ Fixed — changed > 0 to >= 0 to prefer Kilo on ties
transform-package-json.ts: Change label (Kilo newer) was inaccurate	✅ Fixed — renamed to (preserved Kilo pin)

Files Reviewed (5 files)

• package.json — version bump, no issues
• script/upstream/README.md — docs update, no issues
• script/upstream/merge.ts — previous warning resolved
• script/upstream/transforms/transform-package-json.ts — all 3 previous suggestions resolved
• script/upstream/transforms/transform-package-json.test.ts — tests updated correctly, tie-breaking test now uses build metadata variants (+kilo vs +upstream) which is semantically correct given how compareVersions ignores build metadata

---

_{Reviewed by claude-4.6-sonnet-20260217 · 270,996 tokens}

_{Review guidance: REVIEW.md from base branch main}