Add reproducible Bun packaging for desktop and server

- Add shared Nix node-modules derivation and Bun normalization scripts
- Package the desktop and server apps from the normalized install tree

packages/common.nix

@@ -20,6 +20,9 @@
 in {
   inherit workspacePreparePatched;
 
+  # `bun.lock` pins dependency resolution, but Bun's materialized install tree is
+  # not stable enough to hash directly across machines. Normalize Bun-managed
+  # layout before the fixed-output copy, and keep native rebuilds outside the FOD.
   mkNodeModules = {
     pname,
     version,
@@ -67,13 +70,22 @@ in {
           --no-progress \
 ${renderBunFilters filters}
 
+        bun --bun ${../nix/scripts/canonicalize-node-modules.ts}
+        bun --bun ${../nix/scripts/normalize-bun-binaries.ts}
+
         runHook postBuild
       '';
 
       installPhase = ''
         runHook preInstall
 
-        cp -LR ./node_modules $out
+        mkdir -p "$out"
+        cp -RP ./node_modules/. "$out/"
+
+        find "$out" -type d -exec chmod u+rwx,go+rx {} +
+        find "$out" -type f -exec chmod u+rw,go+r {} +
+        find "$out" -type f \( -path "$out/.bin/*" -o -path '*/node_modules/.bin/*' \) -exec chmod u+rwx,go+rx {} +
+        find "$out" -exec touch -h -d '@1' {} +
 
         runHook postInstall
       '';

packages/desktop/default.nix

@@ -50,8 +50,9 @@ in
 
     nodeModules = common.mkNodeModules {
       inherit (finalAttrs) pname version src;
-      outputHash = "sha256-mzcaRKIymMQb934wrto/mBuKt0KzncbzUQ0rzkCLlC4=";
+      outputHash = "sha256-vOCDwW/t7CbqHyeDE6Nvnlq0c9NO5T/2h1NJKLERGSs=";
       filters = [
+        "."
         "./apps/desktop"
         "./apps/server"
         "./apps/web"

packages/server/default.nix

@@ -31,8 +31,9 @@ in
 
     nodeModules = common.mkNodeModules {
       inherit (finalAttrs) pname version src;
-      outputHash = "sha256-l0BXsHRRFPyWjdxWedAdS8K7VdXSzAfw5c+0caqzT6M=";
+      outputHash = "sha256-eXNOHRuNv9XFhXmsFtkunZswtRPd8gzJB1Jdw2DxYZY=";
       filters = [
+        "."
         "./apps/server"
         "./apps/web"
         "./packages/client-runtime"