build: upgrade to pnpm 12

[lukecotter]

📝 PR Overview

Moves the repo from pnpm 10.34.5 to pnpm 12.4.2.

pnpm 11 is the breaking release: it reads only registry and auth keys from .npmrc, replaces the
four build-script settings with one allowBuilds map, and turns on strictDepBuilds,
minimumReleaseAge and blockExoticSubdeps by default. pnpm 12 keeps pnpm 11's commands, flags
and lockfile format, and ships as a native binary.

Two commits: the settings move and pnpm 11 first, then the 12 bump on its own, so a CI failure has
one candidate cause.

pnpm-lock.yaml is unchanged through both. No dependency resolves differently.

🛠️ Changes made

• .npmrc keeps registry only. auto-install-peers and shamefully-hoist move to
  pnpm-workspace.yaml as autoInstallPeers and shamefullyHoist.
• pnpm-workspace.yaml gains allowBuilds with ten entries, all declined. The same packages were
  already ignored under pnpm 10 and every job passed, so this records today's behaviour and
  satisfies strictDepBuilds. pnpm approve-builds edits the map.
• package.json pins packageManager: "pnpm@12.4.2". This is the single source of truth for the
  version; Dependabot cannot bump it, so it is raised by hand.
• Workflows replace pnpm/action-setup@v6.1.0 + actions/setup-node@v7 with one pnpm/setup@v2
  step (runtime: node@24, cache: true, install: false). It reads the version from
  packageManager, so the next bump touches one file instead of five.
• Each workflow sets PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: false. That setting now defaults to
  install, which would let a later pnpm run start a second install without ci:install's
  --ignore-scripts, and a pnpm --filter lana … step install the whole workspace. The default
  stays on for local work, where it auto-heals a stale node_modules.
• minimumReleaseAge stays at the new 1440 default. It cannot fire in CI, since
  --frozen-lockfile does not resolve, and Dependabot's 7/14-day cooldown always binds first.
• DEVELOPING.md and AGENTS.md record the version pin, where settings live now, and the
  ERR_PNPM_IGNORED_BUILDS remedy.

🧩 Type of change (check all applicable)

• 🐛 Bug fix - something not working as expected
• ✨ New feature – adds new functionality
• ♻️ Refactor - internal changes with no user impact
• ⚡ Performance Improvement
• 📝 Documentation - README or documentation site changes
• 🔧 Chore - dev tooling, CI, config
• 💥 Breaking change

Not a breaking change for the extension. It is a breaking change for a contributor's local setup:
pnpm 12 is required, and npm i -g pnpm@12 is now in the prerequisites.

📷 Screenshots / gifs / video [optional]

None — no UI change.

🔗 Related Issues

None.

✅ Tests added?

• 👍 yes
• 🙅 no, not needed
• 🙋 no, I need help

No product code changed. The acceptance test is that the existing suite and the packaged artefact
come out the same. Run locally on 12.4.2 against a wiped node_modules:

• pnpm install — 1,948 packages, all reused from the store, nothing downloaded. No
  ERR_PNPM_IGNORED_BUILDS, no unrecognised-setting error.
• pnpm-lock.yaml — byte-identical, still one YAML document at lockfileVersion: '9.0' with no
  packageManagerDependencies. Dependabot keeps parsing it, and the pnpm 12 cycle-breaking rewrite
  never fired.
• node_modules/.modules.yaml — publicHoistPattern: ["*"] intact, so shamefullyHoist survived
  the move out of .npmrc, and ignoredBuilds: [].
• pnpm run lint — 0 errors, 12 pre-existing no-console warnings.
• jest — 138 + 2,084 + 395 = 2,617 pass across the three projects.
• pnpm --filter lana run build:vsix — 26 files, 1021.42 KB, identical to the pnpm 10 baseline by
  filename and byte size.
• pnpm run build:fast, cd lana-docs && pnpm run build, pnpm run test:e2e:web — all pass.

Not covered: publish.yml and cd-prerelease.yml cannot run from a branch. Both were read by hand
and share the setup block CI exercises; the local vsix build covers their packaging step.

📚 Docs updated?

• 🔖 README.md
• 🔖 CHANGELOG.md
• 📖 help site
• 🧪 Marked any pre-release-only features (README 🧪 badge — see RELEASING.md)
• 🙅 not needed

DEVELOPING.md and AGENTS.md are updated. No CHANGELOG entry: build tooling is invisible to
extension users. No README or help-site change, and no pre-release-only feature.

Anything else we need to know? [optional]

strictDepBuilds can turn a future Dependabot PR red. The first time a transitive dependency
gains an install script, pnpm install fails with ERR_PNPM_IGNORED_BUILDS until someone reviews
it and runs pnpm approve-builds. That is the point of the setting, but it is new.

pnpm 12 rejects an X.509 v1 client certificate. Its Rust TLS stack fails at startup with
invalid peer certificate: UnsupportedCertVersion if a certfile in a global .npmrc points at a
v1 cert, before any network call and for every project on the machine. Nothing in this repo is
affected and CI runners are not, but anyone with mTLS client certs in ~/.npmrc will need theirs
reissued as v3.

First CI run is worth watching for two things: that pnpm/setup@v2 puts node on PATH for
jest, rollup, rolldown, tsx, docusaurus and playwright; and that no job logs a second install after
ci:install, which is what the env var prevents.