fix(ci): pin pnpm to v10 and approve builds via onlyBuiltDependencies

[PAMulligan]

Root cause

CI's pnpm/action-setup@v4 used version: latest, which floated onto pnpm 11. pnpm 11 hard-fails pnpm install --frozen-lockfile with ERR_PNPM_IGNORED_BUILDS when a dependency has an unapproved native build script (esbuild). The earlier allowBuilds: workaround is a pnpm v11-only key that is silently ignored on v10 — and v11 in turn ignores the documented v10 onlyBuiltDependencies key. So the approval mechanism is version-dependent, and a floating pnpm version can re-break it at any time.

One-line: pnpm v10+ blocks dependency build scripts; standardized on the documented onlyBuiltDependencies approval and pinned pnpm to v10 (v11 renames the key to allowBuilds).

Fix

• Pin pnpm to v10 — pnpm/action-setup@v6 with version: 10 in all four jobs (was @v4 version: latest). No packageManager field added, so version: 10 is the single source of truth.
• Documented approval — replaced allowBuilds: with onlyBuiltDependencies: [esbuild, sharp] in app/pnpm-workspace.yaml.
• Clear Node 20 deprecation — bumped actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v7.

No lockfile regeneration required (--frozen-lockfile stays valid). No masking flags (no || true, no --no-frozen-lockfile, no disabled checks).

Verification (local, reproduced before & after)

pnpm	config	result
11.9.0	none	❌ ERR_PNPM_IGNORED_BUILDS, exit 1 — reproduces the original failure
11.9.0	onlyBuiltDependencies	❌ exit 1 — v11 ignores this key
10.15.1	none	⚠️ warning, exit 0
10.15.1	onlyBuiltDependencies	✅ esbuild postinstall runs, exit 0, lockfile valid
real app/, committed files	—	✅ exit 0, no warning, no approve-builds prompt; esbuild binary verified working

Note: sharp@0.35.2 has no install-time script (prebuilt @img/* binaries); it is listed defensively. The action major bumps use only standard inputs but can't be exercised locally — they'll be confirmed on first CI run.

🤖 Generated with Claude Code