The instructions however make no mention of supplementary bonding...

It will need supplementary bonding as it has an earth terminal. However,
with plastic pipework, there might not be another fitting in the room that
requires it. You shouldn't supplementary bond metal baths or radiators fed
by plastic pipe.

The instructions also contain a diagram showing the bathroom zones,
with a Zone 2 being defined for the area within a 60cm radius of the
basin tap. Zone 1 is defined as requiring IP45 or better - with mains
voltage fittings requiring a separate circuit and a 30Ma RCD, with
Zone 2 requiring IP44 or better.

That sounds all wrong. Zoning is in relation to the shower tray or bath tub.

bonding to the ceiling light, or putting in some form of RCD spur
(TLC's Order Codes CM 4904 / BR H92 ) ...and finding somewhere to put
it and regularly test it !) specifically for the mirror light.

This is what you should do. The manufacturer's instructions say it should
have an RCD to be suitable for bathroom use, so this overrides any general
requirement in the regulations.

Whilst you are there, you may wish to rejig your consumer unit so that all
socket circuits (except the fridge/freezer) are RCD protected. This greatly
improves the safety of the installation.

Christian.