fix(ci): approve esbuild/sharp builds via pnpm v11 allowBuilds setting

pnpm v11 (CI uses pnpm@latest) removed onlyBuiltDependencies/ignoredBuiltDependencies and replaced them with `allowBuilds`. The old keys were silently ignored, so `pnpm install --frozen-lockfile` kept failing with ERR_PNPM_IGNORED_BUILDS on esbuild. Reproduced and verified the fix locally with pnpm 11.9.0 (clean node_modules + frozen install now exits 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Paul Mulligan

app/pnpm-workspace.yaml

@@ -1,5 +1,6 @@
-# pnpm settings live here (pnpm 10+). Approve build scripts so CI's
-# `pnpm install --frozen-lockfile` doesn't fail with ERR_PNPM_IGNORED_BUILDS.
-onlyBuiltDependencies:
-  - esbuild
-  - sharp
+# pnpm build-script approval. pnpm v11 replaced onlyBuiltDependencies with
+# `allowBuilds`; this allows esbuild's (and sharp's) postinstall so CI's
+# `pnpm install --frozen-lockfile` passes instead of ERR_PNPM_IGNORED_BUILDS.
+allowBuilds:
+  esbuild: true
+  sharp: true