chore: bump pnpm 10.33.0 to 11.0.9

[CaseyHoover]

Summary

Closes #118.

• Bump both pnpm pin sites to 11.0.9:
  • packageManager in root package.json
  • RUN npm install -g pnpm@… in .devcontainer/Dockerfile
• Migrate package.json#pnpm.* settings into pnpm-workspace.yaml (pnpm v11 no longer reads them from package.json):
  • onlyBuiltDependencies (list) → allowBuilds (boolean map). All previously-approved packages are kept allowed.
  • ignoredOptionalDependencies moves verbatim.
• pnpm install regenerates the lockfile. v11's lockfile is more compact (drops some unused peer-dependency context tags), which accounts for most of the line delta.

Notes on v11 compatibility

• Node 22+ required: devcontainer is on node:26.0-slim, so we're safe.
• .npmrc is auth/registry-only: this repo doesn't have an .npmrc, so nothing to migrate.
• minimumReleaseAge defaults to 1 day and blockExoticSubdeps defaults to true: defaults are kept.
• strictDepBuilds true by default: every package previously listed in onlyBuiltDependencies is now true in allowBuilds, so no install error.

Test plan

• pnpm install completes
• pnpm lint:pinning — Pinning policy: OK
• pnpm lint — 5/5 tasks successful
• pnpm build — 3/3 tasks successful
• pnpm test — 4 test files, 20 tests passed
• Clean devcontainer rebuild (verify the npm install -g pnpm@11.0.9 line builds)

🤖 Generated with Claude Code