ci(deps): use pnpm 11 allowBuilds map to approve esbuild + core-js

Context: commit 82aeaba tried to fix the pnpm 11 ERR_PNPM_IGNORED_BUILDS
CI failure by adding `onlyBuiltDependencies` to pnpm-workspace.yaml. That
fix passed a local check but CI still failed (run 26726781987) with the
same error.

Problem: `onlyBuiltDependencies` (the pnpm 10 list field) was REMOVED in
pnpm 11, which the bumped packageManager pin now installs. pnpm 11
ignores the unknown key and the build-script gate stays unsatisfied, so
esbuild@0.27.3 and core-js@3.49.0 are still flagged and the install
aborts. The earlier local verification was a false positive: it ran
against a populated node_modules, so pnpm reported "Already up to date"
and never evaluated build scripts at all.

Solution: replace `onlyBuiltDependencies` with pnpm 11's `allowBuilds`
map, marking esbuild and core-js as `true`.

Behavior: verified against a clean tree (rm -rf node_modules) with
`CI=true pnpm install --frozen-lockfile` -> exit 0, zero
ERR_PNPM_IGNORED_BUILDS, and esbuild's binary builds and runs
(`esbuild --version` -> 0.27.3). The same clean-install command on the
prior commit reproduced the CI failure (exit 1).

Files:
- pnpm-workspace.yaml:23-32 swap onlyBuiltDependencies list for the
  allowBuilds map (esbuild: true, core-js: true)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: diegorv

pnpm-workspace.yaml

@@ -21,15 +21,12 @@ overrides:
   cookie: '>=0.7.0'
 
 # Dependencies allowed to run install/build scripts. pnpm 11 (see
-# package.json#packageManager) hard-fails `pnpm install` with
-# ERR_PNPM_IGNORED_BUILDS when CI=true and a dependency with a build
-# script is not listed here; locally it only warns, which is why the
-# break surfaced in CI but not on dev machines. esbuild's postinstall
-# links its platform binary; core-js's is a donation notice.
-onlyBuiltDependencies:
-  - esbuild
-  - core-js
-
+# package.json#packageManager) replaced the v10 `onlyBuiltDependencies`
+# list with the `allowBuilds` map and made the gate strict by default:
+# any dependency declaring an install/build script that is NOT listed
+# here aborts `pnpm install` with ERR_PNPM_IGNORED_BUILDS in CI. esbuild
+# (pulled by vite) links its platform binary; core-js (pulled by
+# feather-icons) runs a donation-notice postinstall.
 allowBuilds:
-  core-js: true
   esbuild: true
+  core-js: true