[socket-patch] Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched

## Observed symptom Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched [agent] Found by the scheduled Bun bug-hunt routine (ledger #306). With Bun's isolated linker, every package lives at `node_modules/.bun/<name>@<version>/node_modules/<name>`. The importer's `node_modules` only holds symlinks to its *direct* deps. Agent mode never looks inside `node_modules/.bun`, so a **transitive** dependency is treated as lockfile-only. `scan --mode agent` reports it `skipped` / `package_not_installed`, doesn't record it in the manifest, and exits 0 with `status: "success"`. The installed copy stays unpatched. ## Environment GitHub SocketDev/socket-patch #366 ## Trigger / context Public GitHub report in SocketDev/socket-patch (FRESH_7D). ## Source evidence - https://github.com/SocketDev/socket-patch/issues/366 (2026-10-01T19:25:25Z) — evidence_class: PRIMARY_ISSUE_REPORT — #366 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:48:57.646025Z - scout_id: Cd9aba51049 ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.