fix: drop --ignore-workspace from test-app:install (defeats #649 security overrides)

The first live run of the layer-3 device path failed at
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, and the cause is a real latent bug rather
than a stale lockfile.

#649 moved the fixture app's `overrides` into examples/test-app/pnpm-workspace.yaml
precisely because pnpm only honors overrides from a workspace root — they pin
transitive deps (ws, brace-expansion, xmldom, postcss, uuid, shell-quote) to
versions that clear Dependabot alerts. But `test-app:install` passes
--ignore-workspace, which ignores that very file, so the overrides are dropped
and no longer match the lockfile that has them baked in. It goes unnoticed
locally because interactive installs are not frozen, and no CI job has ever
installed this app.

Dropping --ignore-workspace makes examples/test-app resolve as its own workspace
root (it has its own pnpm-workspace.yaml and is not a member of the repo-root
workspace), so the overrides apply and a frozen install succeeds. Verified both
directions locally: with the flag + --frozen-lockfile reproduces the CI failure;
without it, a frozen install completes and the lockfile's overrides stay intact.

Note the workaround this replaces would have been actively harmful: installing
with --no-frozen-lockfile resolves the mismatch by regenerating the lockfile
WITHOUT the overrides, silently reverting the app to the vulnerable transitive
versions #649 pinned away.

Author: thymikee

.github/workflows/conformance-differential.yml

@@ -81,13 +81,7 @@ jobs:
       - name: Build and install the fixture app
         run: |
           set -euo pipefail
-          # Not `pnpm test-app:install`: CI implies --frozen-lockfile, and the
-          # fixture app's lockfile is out of sync with its package.json overrides
-          # (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH). No CI job has ever built this app,
-          # so that drift went unnoticed. Install unfrozen here rather than change
-          # the shared script; the fixture app is a device-test dependency, not a
-          # shipped artifact.
-          pnpm install --dir examples/test-app --ignore-workspace --no-frozen-lockfile
+          pnpm test-app:install
           pnpm --dir examples/test-app exec expo run:ios \
             --configuration Release \
             --device "iPhone 17 Pro" \

package.json

@@ -133,7 +133,7 @@
     "check": "pnpm check:tooling && pnpm check:fallow && pnpm check:unit",
     "prepack": "pnpm check:mcp-metadata && pnpm build:all && pnpm package:apple-runner:npm && pnpm package:android-snapshot-helper:npm && pnpm package:android-multitouch-helper:npm && pnpm package:android-ime-helper:npm",
     "typecheck": "tsc -p tsconfig.json",
-    "test-app:install": "pnpm install --dir examples/test-app --ignore-workspace",
+    "test-app:install": "pnpm install --dir examples/test-app",
     "test-app:start": "pnpm --dir examples/test-app start",
     "test-app:ios": "pnpm --dir examples/test-app ios",
     "test-app:android": "pnpm --dir examples/test-app android",