fix(docker): allow pruned lockfile normalization

[TheodoreSpeaks]

Summary

• remove frozen-lockfile enforcement from the app and migrations Docker dependency stages
• document why partial workspace manifests require Bun to normalize the full root lockfile
• retain the full-repository frozen install in test-build as the canonical lockfile consistency gate

Why

PR #7343 added frozen-lockfile enforcement to Docker stages that intentionally copy only a subset of workspace manifests. The root bun.lock describes every workspace, so Bun 1.3.14 needs to remove unrelated workspace entries before installing the app or migration dependency graph. Freezing that expected normalization caused both image builds to fail with "lockfile had changes, but lockfile is frozen" and skipped image promotion.

Failed run: https://github.com/simstudioai/sim/actions/runs/33493411083/job/99810890876
Regression commit: fd061f5

Verification

• Bun 1.3.14 lockfile-only install for the Turbo-pruned @sim/app graph using the hoisted linker and linux/x64 target
• Bun 1.3.14 lockfile-only install for the migrations manifest subset using the linux/x64 target
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 1, 2026 10:17am UTC

[greptile-apps]

Greptile Summary

This PR allows Bun to normalize the full root lockfile when installing dependencies from partial workspace manifests while retaining full-repository frozen-lockfile validation in CI.

• Removes --frozen-lockfile from the pruned app dependency stage.
• Removes --frozen-lockfile from the migration dependency stage.
• Documents why these partial-manifest Docker stages require lockfile normalization.

Confidence Score: 5/5

The PR appears safe to merge with no concrete blocking or non-blocking issues identified.

The changed Docker stages deliberately permit Bun to remove unrelated workspace entries from the full lockfile, while full-repository CI retains the canonical frozen-lockfile consistency check.

Important Files Changed

Filename	Overview
docker/app.Dockerfile	Allows expected lockfile normalization for the Turbo-pruned application graph; no actionable defect was established.
docker/db.Dockerfile	Allows expected lockfile normalization for the closed migration workspace subset; no actionable defect was established.

_{Reviews (1): Last reviewed commit: "fix(docker): allow pruned lockfile norma..." | Re-trigger Greptile}