docs: document installing PicJS and allowing its install script

[marc0olo]

Stack of 4 — merge bottom to top. Review each layer against the one below it, not main.

    1. #284 — security fix: dependency advisories, bun.lock removal
    2. #285 — contributor setup docs
    3. #286 — consumer_install job, retires e2e_test_bun
→ 4. #288 — consumer install guidance

Repo installs are pnpm-only: pnpm.overrides, minimumReleaseAge and onlyBuiltDependencies are pnpm-only fields, so a second installer resolves a graph that bypasses them. Bun remains a supported consumer runtime, covered by consumer_install (bun) from layer 3.

Fixes the consumer install instructions. PicJS downloads the pocket-ic binary from a postinstall script, and npm, pnpm and bun all block install scripts by default — so the binary is missing and PocketIcServer.start() fails.

Three problems:

• getting-started.mdx never showed how to install @dfinity/pic, or that the install script needs permitting. No guide did.
• running-tests.mdx stated the binary is "downloaded when installing @dfinity/pic", which is untrue by default for three of the four supported package managers.
• using-bun.mdx held the only opt-in documented anywhere.

Adds an Installing PicJS section to the getting started guide with the install command and required entry per package manager, corrects the running tests guide, and points the bun guide at the shared section.

Opt-ins, each verified against a registry install

Package manager	Entry in package.json
npm 12	"allowScripts": { "@dfinity/pic": true }
pnpm 10	"pnpm": { "onlyBuiltDependencies": ["@dfinity/pic"] }
bun 1.3	"trustedDependencies": ["@dfinity/pic"]
yarn 1	not needed

Confirmed by installing @dfinity/pic from the registry with each and asserting the binary lands. The consumer_install job from #286 covers the pnpm, bun and yarn mechanisms on every run; npm's is only partly covered there, because a tarball install keys allowScripts by file: path rather than by name.

Tabs match the idiom in using-jest.mdx, using-vitest.mdx and using-bun.mdx. Nothing in this repo renders MDX — the docs build is typedoc plus a copy — so the rendered page is worth an eye.

Longer term this friction is better removed than documented: shipping the binary as platform-specific optionalDependencies gated on os/cpu needs no install script and no opt-in, which is the approach esbuild, swc and sharp all moved to. Out of scope here.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No unresolved review issues remain.

Pull request overview

Updates PicJS documentation with installation instructions and package-manager permissions for downloading the PocketIC binary.

Changes:

• Adds install commands and opt-ins for npm, pnpm, Bun, and Yarn.
• Corrects binary download guidance in the testing guide.
• Links Bun guidance to the shared installation section.

File summaries

File	Description
docs/src/content/docs/guides/using-bun.mdx	References shared install-script guidance.
docs/src/content/docs/guides/running-tests.mdx	Clarifies the binary setup requirement.
docs/src/content/docs/guides/getting-started.mdx	Adds installation and permission guidance.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The documentation updates are complete with no unresolved blocking issues.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite