fix(bun): guard against missing keys in cache manifest

[chrisolszewski]

Ran into this crash locally while developing a plugin and modifying dependencies/dev-dependencies.

The cached package.json can be valid but missing the dependencies key (e.g. if it only has devDependencies). This ensures we default to {} to prevent the TypeError.