chore: pin pnpm version via packageManager field (#623)

* chore: pin pnpm version via packageManager field

Adds 'packageManager': 'pnpm@10.33.0' to root package.json so that
contributors using corepack get the same pnpm version as CI
(.github/workflows/_build.yaml uses pnpm/action-setup@v4 with version 10).

Also bumps the engines.pnpm range from '>=8.0.0' to '>=10.0.0' for
consistency. The previous loose constraint allowed contributors to
regenerate pnpm-lock.yaml with pnpm 8 or 9, which strips lockfile-v9+
fields like 'libc' from native package entries — exactly what happened
in #621 and required #622 as a follow-up cleanup.

This is a recurrence-prevention measure following that incident.

* ci: pin pnpm to 10.33.0 in _build.yaml to match packageManager

Addresses CodeRabbit feedback on this PR — packageManager pins to
10.33.0 exactly, but CI was floating on 'version: 10' which allowed
patch-level drift. Now both local (via corepack) and CI use the same
exact pnpm version.

---------

Co-authored-by: kwit75 <noreply@anthropic.com>

Author: 2 people

.github/workflows/_build.yaml

@@ -76,7 +76,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
         with:
-          version: 10
+          version: 10.33.0
       - name: Set up vcpkg
         run: ${{ matrix.builder_cmd }} vcpkg:submodule-build
       - name: Set up vcpkg nuget / Linux/macOS

package.json

@@ -34,9 +34,10 @@
 	"scripts": {
 		"prepare": "lefthook install --force"
 	},
+	"packageManager": "pnpm@10.33.0",
 	"engines": {
 		"node": ">=18.0.0",
-		"pnpm": ">=8.0.0"
+		"pnpm": ">=10.0.0"
 	},
 	"pnpm": {
 		"peerDependencyRules": {