fix(nix): remove build-time Bun closure reference

nix/package.nix

@@ -11,6 +11,7 @@
   ninja,
   pipewire,
   pkg-config,
+  removeReferencesTo,
   rustPlatform,
   rustToolchain,
   source,
@@ -85,6 +86,7 @@ stdenv.mkDerivation {
     cmake
     ninja
     pkg-config
+    removeReferencesTo
     rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
     rustToolchain
@@ -186,6 +188,15 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  # Bun serializes the build interpreter path into the bundled entrypoint's
+  # inert shebang. Remove its hash before Nix scans output references; this
+  # runs before Darwin's binary-signing fixup hook.
+  preFixup = ''
+    remove-references-to -t ${bun} "$out/bin/omp"
+  '';
+
+  disallowedReferences = [ bun ];
+
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck

packages/coding-agent/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- Fixed Nix standalone binaries retaining Bun's build-time package in their runtime closure.
+
 ## [17.3.0] - 2026-08-13
 
 ### Breaking Changes