fix(ci): restore isolated Bun test execution for mock.module suites

Running Linux CI in one Bun process still leaks mock.module registrations across files, so the workflows now use a CI-specific test runner that isolates mock-heavy targets before executing the remaining suite together.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

script/publish-workflow.test.ts

@@ -1,3 +1,5 @@
+/// <reference types="bun-types" />
+
 import { describe, expect, test } from "bun:test"
 import { readFileSync } from "node:fs"
 
@@ -7,16 +9,14 @@ const workflowPaths = [
 ]
 
 describe("test workflows", () => {
-  test("use a single plain bun test step without isolated split hacks", () => {
+  test("use the CI-safe test runner for workflows", () => {
     for (const workflowPath of workflowPaths) {
       // given
       const workflow = readFileSync(workflowPath, "utf8")
 
       // then
       expect(workflow).toContain("- name: Run tests")
-      expect(workflow).toContain("run: bun test")
-      expect(workflow).not.toContain("Run mock-heavy tests (isolated)")
-      expect(workflow).not.toContain("Run remaining tests")
+      expect(workflow).toContain("run: bun run test:ci")
     }
   })
 })