feat(rush-lib): add pnpm 11 allowBuilds support, deprecate globalNeverBuiltDependencies

[Copilot]

New Feature

Rush had no support for pnpm 11's allowBuilds setting, and globalNeverBuiltDependencies is now obsolete — pnpm 11 removed reading build settings from package.json entirely, requiring all such config in pnpm-workspace.yaml.

What does this feature do?

Introduces globalAllowBuilds in pnpm-config.json — a Record<string, boolean> map that controls per-package build script permissions, written to allowBuilds in the generated pnpm-workspace.yaml (pnpm 11.0.0+):

// common/config/rush/pnpm-config.json
"globalAllowBuilds": {
  "esbuild": true,
  "playwright": true,
  "core-js": false
}

Deprecates globalNeverBuiltDependencies:

• pnpm < 11: emits a deprecation warning; continues writing neverBuiltDependencies to package.json for backward compat
• pnpm ≥ 11: emits a warning that the setting will be ignored (pnpm 11 dropped package.json pnpm-field support entirely)
• Setting both globalNeverBuiltDependencies and globalAllowBuilds simultaneously throws an error

Migration: replace "globalNeverBuiltDependencies": ["pkg"] with "globalAllowBuilds": { "pkg": false }.

Why is this feature needed?

pnpm 11.0.0 removed neverBuiltDependencies, onlyBuiltDependencies, and related settings, replacing them with a single unified allowBuilds map in pnpm-workspace.yaml. Without this change, Rush users on pnpm 11 silently lose build-script control.

Implementation details

• pnpm-config.schema.json — new globalAllowBuilds property (additionalProperties: boolean); globalNeverBuiltDependencies description marked @deprecated
• PnpmOptionsConfiguration.ts — new globalAllowBuilds class property; @deprecated JSDoc on globalNeverBuiltDependencies; mutual exclusion guard (throws if both are set)
• PnpmWorkspaceFile.ts — new setAllowBuilds() method; allowBuilds serialized into the generated pnpm-workspace.yaml
• WorkspaceInstallManager.ts — calls setAllowBuilds() with a version guard warning for pnpm < 11
• InstallHelpers.ts — version-aware deprecation warning for globalNeverBuiltDependencies; skips writing to package.json on pnpm ≥ 11
• pnpm-config.json template — documents new setting; deprecation note and migration guidance on old setting