ci(deps): approve esbuild + core-js build scripts for pnpm 11

Context: commit e8aa086 bumped package.json#packageManager from
pnpm@10.30.3 to pnpm@11.3.0. pnpm/action-setup honors that field, so CI
now installs pnpm 11.

Problem: pnpm 11 turns ERR_PNPM_IGNORED_BUILDS into a hard failure
(exit 1) when CI=true and a dependency declaring an install/build script
is not on the approval list. The repo had no onlyBuiltDependencies at
all, so both esbuild@0.27.3 and core-js@3.49.0 were flagged and
`pnpm install --frozen-lockfile` aborted in the setup action. It passed
on dev machines because pnpm 11 only warns (exit 0) outside CI.

Solution: add onlyBuiltDependencies to pnpm-workspace.yaml listing the
only two packages in the tree that ship build scripts. esbuild (pulled
by vite) links its platform binary; core-js (pulled by feather-icons)
runs a donation-notice postinstall.

Behavior: `CI=true pnpm install --frozen-lockfile` now exits 0 with no
ignored-builds error (verified: pre-fix exit 1, post-fix exit 0).

Files:
- pnpm-workspace.yaml:20-31 add onlyBuiltDependencies (esbuild, core-js)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: diegorv

pnpm-workspace.yaml

@@ -19,3 +19,13 @@ minimumReleaseAgeExclude:
 
 overrides:
   cookie: '>=0.7.0'
+
+# Dependencies allowed to run install/build scripts. pnpm 11 (see
+# package.json#packageManager) hard-fails `pnpm install` with
+# ERR_PNPM_IGNORED_BUILDS when CI=true and a dependency with a build
+# script is not listed here; locally it only warns, which is why the
+# break surfaced in CI but not on dev machines. esbuild's postinstall
+# links its platform binary; core-js's is a donation notice.
+onlyBuiltDependencies:
+  - esbuild
+  - core-js