fix: use --preload= for bun compatibility

[Emeralddddd]

Summary

• Change --preload <path> to --preload=<path> (equals sign syntax) for both dns-guard and fingerprint-hook BUN_OPTIONS
• Bun requires the = form; space-separated form silently fails to load preload scripts

Test plan

• Verify dns-guard preload works with bun runtime
• Verify fingerprint-hook preload works with bun runtime
• Confirm no regression with node runtime (NODE_OPTIONS unchanged)

[nmhjklnm]

I found one blocking issue.

src/templates.sh changes the BUN_OPTIONS form from --preload <path> to --preload=<path>, but this does not appear to fix the actual problem. I tested both forms locally against Bun 1.1.29 using a compiled standalone executable (the scenario Bun documents for BUN_OPTIONS), and in both cases the preload script was still not loaded.

So the current PR changes syntax, but does not demonstrate that CAC hooks (cac-dns-guard.js / fingerprint-hook.js) will actually be injected in the Bun executable case.

Please add an end-to-end validation against a compiled Bun executable / real Claude binary before merging. Right now this looks like it changes the spelling without fixing the behavior.