fix(ci-local): the gates lane ran bun over workspace TS with no node_modules

`owned template copies current` has been RED on every hosted `local-ci` run and
GREEN on every warm dev box. It is not flake and it is not the gate's content: on
a fresh CI checkout there is no `node_modules`, and the lane's only `bun install`
sat inside `gate_fixture_lint` near the END. Cold, the script's relative import of
`codegen-ts/src/index.js` reaches `src/templates/filter-shared.ts`, whose bare
`@metaobjectsdev/metadata` specifier cannot resolve —

    error: Cannot find module '@metaobjectsdev/metadata' from
    .../codegen-ts/src/templates/filter-shared.ts

The failure was the loud half of a class whose quiet half is worse: bun
auto-installs a bare specifier from the registry, so a cold gate can bind the
PUBLISHED package instead of the working tree and pass, gating a release against
a stale loader with two physical copies of the metamodel in one process.

The standing rule was "any new gates step that touches workspace TS must start
with `bun_install &&`" — a rule each new gate has to remember, and this one did
not. Install ONCE at the head of the bun-requiring section instead, so the class
is unreachable rather than patched. The existing per-gate prefixes stay: they cost
6ms warm and keep each gate runnable on its own.

Proven on a genuinely cold tree (root `node_modules` moved aside), both
directions: without the step the gate fails to resolve; with it the full lane is
LOCAL CI PASSED, 27 gates, from nothing installed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTcEKXTQMYt84fAjuw5A2M

Author: dmealing

scripts/ci-local.sh

@@ -684,6 +684,15 @@ if want gates; then step    "script-name hook collisions"      gate_script_name_
 if want gates; then step    "no-magic gate wired (5 ports)"    gate_no_magic_coverage;      fi
 if want gates; then step    "test-file references resolve"     gate_test_references;        fi
 if want gates; then step    "metamodel-version bump"           gate_metamodel_version;      fi
+# Every gate below this line runs bun over workspace TypeScript, and on a FRESH CI
+# checkout there is no node_modules — so a bare `@metaobjectsdev/*` specifier either
+# fails to resolve (what `owned template copies current` did, red on CI and green on
+# every warm dev box) or, worse, silently binds the PUBLISHED package out of bun's
+# install cache and gates the release against a stale loader. Installing ONCE here
+# makes that class unreachable instead of asking each new gate to remember a
+# `bun_install &&` prefix; the prefixes that already exist stay, so each gate is still
+# runnable on its own. Warm cost is ~6ms.
+if want gates; then step_if bun "dependencies installed"       bun_install;                 fi
 if want gates; then step_if bun "peer-range bounds"            gate_peer_ranges;            fi
 if want gates; then step_if bun "owned template copies current" gate_owned_template_copies; fi
 if want gates; then step_if bun "reference templates lint"     gate_reference_templates_lint; fi