fix(installer): disable dependency hooks explicitly across Bun versions

tools/install_portal_clis.py

@@ -18,6 +18,9 @@ skipped and reported instead of installed: those are the hooks that run code
 during `bun install`, and tools/security_guards.py forbids them in-tree. A
 borrowed portal that carries one gets read by a human before it runs.
 
+Every install also passes --ignore-scripts, including on older Bun releases
+that run a built-in list of dependency hooks without trustedDependencies.
+
 Each CLI installs independently; one failure does not stop the rest. Exit 0
 when every CLI installed, 1 when bun is missing, a manifest was skipped, or an
 install failed.
@@ -72,7 +75,7 @@ def install(cli_dirs: list[Path], bun: str, dry_run: bool, root: Path = ROOT, ru
             print(f"would install  {name}")
             continue
         print(f"installing  {name}", flush=True)
-        if run([bun, "install"], cwd=cli_dir).returncode != 0:
+        if run([bun, "install", "--ignore-scripts"], cwd=cli_dir).returncode != 0:
             print(f"FAIL  {name}: bun install exited non-zero")
             failures.append(name)
     if failures: