fix(ci): pin bun-version to 1.3.13 (closes #3)

setup-bun@v2 resolves "latest" by calling
api.github.com/repos/oven-sh/bun/releases/latest at every run.
Post-2026-05-06 the runner host IPs are rate-limited / blocked by
GitHubs api.github.com, so the action fails before bun ever
installs and every Test workflow run goes red.

Pinning skips the network resolve entirely — setup-bun downloads the
specific tag from the oven-sh CDN directly. 1.3.13 is the current
stable per registry.npmjs.org/bun (2026-05-07).

Bump this explicitly in a follow-up PR when a newer bun is needed;
the silent 'always pull latest' flow was a CI-shaped time bomb even
before the suspension.

.github/workflows/test.yml

@@ -20,7 +20,14 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          # Pin to a specific version. setup-bun's `latest` resolves
+          # by hitting api.github.com/repos/oven-sh/bun/releases/latest,
+          # which post-2026-05-06 rate-limits/blocks our runner host
+          # IPs and the action fails before bun ever installs. A pinned
+          # version skips the network resolve entirely and the action
+          # downloads the binary directly from oven-sh's CDN. Bump
+          # explicitly when a new bun is needed (mcp-claude-channel#3).
+          bun-version: '1.3.13'
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run tests