Add reproducible Bun packaging for desktop and server

- Add shared Nix node-modules derivation and Bun normalization scripts
- Package the desktop and server apps from the normalized install tree

packages/common.nix

@@ -20,6 +20,9 @@
 in {
   inherit workspacePreparePatched;
 
+  # `bun.lock` pins dependency resolution, but Bun's materialized install tree is
+  # not stable enough to hash directly across machines. Normalize Bun-managed
+  # layout before the fixed-output copy, and keep native rebuilds outside the FOD.
   mkNodeModules = {
     pname,
     version,
@@ -67,13 +70,22 @@ in {
           --no-progress \
 ${renderBunFilters filters}
 
+        bun --bun ${../nix/scripts/canonicalize-node-modules.ts}
+        bun --bun ${../nix/scripts/normalize-bun-binaries.ts}
+
         runHook postBuild
       '';
 
       installPhase = ''
         runHook preInstall
 
-        cp -LR ./node_modules $out
+        mkdir -p "$out"
+        cp -RP ./node_modules/. "$out/"
+
+        find "$out" -type d -exec chmod u+rwx,go+rx {} +
+        find "$out" -type f -exec chmod u+rw,go+r {} +
+        find "$out" -type f \( -path "$out/.bin/*" -o -path '*/node_modules/.bin/*' \) -exec chmod u+rwx,go+rx {} +
+        find "$out" -exec touch -h -d '@1' {} +
 
         runHook postInstall
       '';