ci: cache bun store instead of node_modules

[Flo0807]

Problem

CI's Test (Demo) → lint:style step crashes on dependency/lockfile PRs (first observed on #1974):

stylelint assets/**/*.css
node_modules/@cacheable/memory/dist/index.js:115
import { Keyv } from "keyv";
SyntaxError: The requested module 'keyv' does not provide an export named 'Keyv'

Root cause

The workflows cached node_modules directly with a restore-keys: fallback and only ran bun install --frozen-lockfile on a cache miss. When a lockfile changed:

1. The exact cache key missed, so restore-keys restored a stale node_modules built from a different lockfile (e.g. develop's @cacheable/memory@2.0.8).
2. A partial restore leaves cache-hit != 'true', so bun install --frozen-lockfile ran incrementally on top of the stale tree.
3. That incremental install could leave a broken hoist: @cacheable/memory (ESM, import { Keyv } from "keyv", needs keyv@5) resolving up to the top-level hoisted keyv@4.5.4 (pulled in by eslint's flat-cache@3.2.0, no named Keyv export) instead of its nested keyv@5.6.0 → stylelint crashes before linting anything.

A clean bun install --frozen-lockfile of the same lockfile produces the correct tree and passes — the failure only happens via the cached/incremental path. Caching node_modules with restore-keys is the anti-pattern here.

Fix

Cache bun's content-addressed install store (~/.bun/install/cache) instead of node_modules, and always run bun install --frozen-lockfile:

• node_modules is rebuilt cleanly from the lockfile on every run → correct hoisting, no stale-tree carryover.
• Installs stay fast because packages come from the warm store (no re-download), not the network. restore-keys is safe on a package store (it's just tarballs, not a hoisted layout).
• The Demo job uses a single store cache keyed on both demo/bun.lock and bun.lock, feeding both the demo and Backpex installs.

Applied to both ci.yml (Backpex + Demo jobs) and elixir-main.yml.

Notes

• The common case (lockfile unchanged) is essentially unaffected — installs hit the warm store and materialize node_modules via hardlinks in ~1s.
• Once this lands on develop, re-running Lock file maintenance #1974's CI (rebased) should go green.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.