node_modules FOD hash is calibrated against one bun version — breaks with any other

Description

The Nix flake's node_modules fixed-output derivation is hash-pinned via nix/hashes.json. Those hashes are calibrated by the nix-hashes CI workflow, which runs with the bun provided by the flake's own nixpkgs input.

Downstream consumers that follow a different nixpkgs (e.g. via inputs.nixpkgs.follows = "nixpkgs" in their flake) build the FOD with a different bun version. bun install resolves and lays out node_modules differently per bun version, so the output hash changes and the FOD fails deterministically:

hash mismatch in fixed-output derivation 'opencode-node_modules-1.18.31+a74c472.drv':
  specified: sha256-FY/I7zxmWA4tMvFZG5WijdqBcDc0No3a/YmKuxlluNg=   (bun 1.3.13, upstream CI)
     got:    sha256-Ppc2Kgb9D9xdkrNMyQgPS6rn/zU5zMqMKvAmrFCj1zQ=   (bun 1.4.2, follower's nixpkgs)

Verified to be deterministic, not environmental: building the same FOD separately with bun 1.3.13 and bun 1.4.2 yields exactly those two different hashes.

This means every follower that pins its own nixpkgs hits this class of failure each time either the upstream bun or theirs moves — see also #47332 (dev-shell bun drift) and #37623 (prior occurrence of a stale hash).

Steps to reproduce

From a flake with inputs.opencode.url = "github:anomalyco/opencode"; inputs.opencode.inputs.nixpkgs.follows = "nixpkgs"; where the follower's nixpkgs ships bun ≠ 1.3.13:

nix build .#packages.<system>.opencode

Suggested directions

Two complementary options:

1. Short term — calibrate against more than one bun. Record hashes.json per bun major version (system × bun), or pin the FOD's bun to upstream's nixpkgs version explicitly so the calibration stays valid regardless of the follower's nixpkgs.
2. Structural — replace the single recursive FOD with a lockfile-aware fetcher (e.g. bun2nix, which fetches packages individually using the integrity hashes already in bun.lock). That makes the FOD bun-version-agnostic by design — the current pain point generalizes to every bun bump, and bun2nix eliminates exactly this class of failure.

Happy to contribute the calibration-side change if agreed.

OpenCode version

dev at a74c472 (nix package, flake consumer)