Bun auto-generates `bun.lock` when its scripts run (`bun run build`, `bun run lint`). The project's web package manager is npm (`package-lock.json`), so the bun lockfile is incidental — not the source of truth. Ignore it to keep the working tree clean for anyone who happens to invoke bun.