feat(update-all): bun self-upgrade + documented non-update exclusions

Step 6.5: bun upgrade (guarded). Deliberate exclusions documented in
place: magic MCP (npx @latest resolves at invocation), graphify claude
install (rewrites curated configs — BDR-028 territory, manual only),
gsd (lock-pinned: make update reinstalls the pin, note added to
plugins.lock.json so the no-op is explicit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zA3Qh2Q1QpcGXzXxKeDHR

plugins.lock.json

@@ -8,7 +8,7 @@
   "gsd": {
     "source": "npm:gsd-pi",
     "version": "2.64.0",
-    "note": "Check latest at https://www.npmjs.com/package/gsd-pi before updating. GSD v2 is a standalone CLI (Pi SDK), not a Claude Code plugin. Run 'gsd' in terminal, not '/gsd' in Claude Code."
+    "note": "Check latest at https://www.npmjs.com/package/gsd-pi before updating. GSD v2 is a standalone CLI (Pi SDK), not a Claude Code plugin. Run 'gsd' in terminal, not '/gsd' in Claude Code. NOTE: update-all.sh honors this pin — 'make update' will NOT advance gsd past it; bump this version deliberately, then re-run."
   },
   "gstack": {
     "source": "https://github.com/garrytan/gstack.git",

update-all.sh

@@ -227,6 +227,27 @@ else
   info "graphifyy not installed — skipping"
 fi
 
+# ── 6.5. Update bun ──
+echo ""
+echo "── Updating bun..."
+if command -v bun &>/dev/null; then
+  if bun upgrade >/dev/null 2>&1; then
+    ok "bun $(bun --version 2>/dev/null || echo '?') (self-upgrade)"
+  else
+    warn "bun upgrade failed — try manually: bun upgrade"
+  fi
+else
+  info "bun not installed — skipping"
+fi
+# NOT updated here, deliberately (audit 2026-07-02):
+# - magic MCP: registered as `npx -y @21st-dev/magic@latest` — npx resolves
+#   the latest release at every invocation, nothing to upgrade.
+# - graphify Claude integration (`graphify claude install`): rewrites curated
+#   CLAUDE.md / .claude/settings.json (BDR-028 guard territory) — re-run
+#   MANUALLY only if a graphify upgrade changes its hook format.
+# - gsd: pinned in plugins.lock.json — Step 4 reinstalls the PIN, it does not
+#   advance it. Bump the lock deliberately, then re-run.
+
 # ── 7. Update Emil Design Engineering skill ──
 echo ""
 echo "── Updating Emil Design Engineering..."