fix: demote ERR_PNPM_IGNORED_BUILDS to warning in publish step (#170)

Set npm_config_strict_dep_builds=false as a job-level env var so pnpm
doesn't fail the release job when a transitive dep (e.g.
unrs-resolver@1.11.1 via eslint-config-etherpad) has a postinstall
script that isn't in any allowlist.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JohnMcLear

.github/workflows/npmpublish.yml

@@ -17,6 +17,11 @@ jobs:
     permissions:
       contents: write   # for the atomic version-bump push (branch + tag)
       id-token: write   # for npm OIDC trusted publishing
+    env:
+      # pnpm 10.7+ treats ignored postinstalls as hard errors. Demote
+      # to warning so new transitive deps (e.g. unrs-resolver) don\'t break
+      # the release step.
+      npm_config_strict_dep_builds: "false"
     steps:
       - uses: actions/setup-node@v6
         with: