ci(publish-smoke): surface the app's resolved pnpm + build approvals before install (#3157)

The Publish Smoke gate died on ERR_PNPM_IGNORED_BUILDS with no way to see
why: the failure was CI-only and every local repro (pnpm 10.31/10.33)
honored the allowlist and exited 0.

The missing fact: the scaffolded app declares no packageManager field (by
design — it must test what a fresh user's pnpm resolves, not this repo's
pin), so with corepack enabled the `pnpm` that installs the app is the
LATEST pnpm (11.x), not the repo-pinned 10.31.0. pnpm 11 makes an
unapproved build script a hard error where pnpm 10 only warned. The app's
build approvals were declared for pnpm 11 in #3119; this adds the missing
visibility so a future red run answers on its own which pnpm ran and
whether it parsed the approvals.

Prints, from inside the app dir right before install: `pnpm --version`,
the build-approval keys pnpm actually resolved (onlyBuiltDependencies via
either allowBuilds or onlyBuiltDependencies), and the pnpm-workspace.yaml
as written. Diagnostics only — never fails the smoke.


Claude-Session: https://claude.ai/code/session_01MN39HnZs8M92iDGqAMcvsK

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

scripts/publish-smoke.sh

@@ -171,6 +171,26 @@ console.log(
 );
 EOF
 
+  # Diagnostics for the ERR_PNPM_IGNORED_BUILDS failure class (#3124). The
+  # scaffolded app declares NO packageManager field (deliberately — see the
+  # header), so the `pnpm` that runs HERE is NOT this repo's pinned 10.31.0:
+  # with corepack enabled, corepack resolves the LATEST pnpm for a directory
+  # with no pin (11.x today). That divergence is the whole reason #3124's local
+  # repro (pnpm 10.31/10.33 both honor the allowlist) never reproduced the CI
+  # red — CI runs a stricter pnpm major. Print the resolved version, the
+  # build-approval config pnpm actually parsed, and the file it parsed it from,
+  # so any future red run answers "which pnpm, and did it see the approvals?"
+  # on its own. Never let a diagnostic fail the smoke (|| true).
+  log "pnpm environment inside the app (no packageManager pin — corepack resolves latest)"
+  ( cd "$APP_DIR"
+    echo "  pnpm --version: $(pnpm --version 2>&1)"
+    echo "  build-approval config pnpm resolved (onlyBuiltDependencies):"
+    pnpm config list 2>/dev/null | grep -iE 'only-built|built-dependencies|strict-dep-builds' | sed 's/^/    /' \
+      || echo "    (no build-related config keys reported)"
+    echo "  pnpm-workspace.yaml as written:"
+    sed 's/^/    /' pnpm-workspace.yaml
+  ) || true
+
   log "Installing (pnpm, tarball-pinned)"
   (cd "$APP_DIR" && pnpm install --no-frozen-lockfile)