ci(release): disable pnpm 11 verifyDepsBeforeRun to fix ubuntu-arm hang (#2290)

Forward-port (the applicable half) of stacklok/stacklok-enterprise-platform#1243
to OSS. The Node 24.15.0 pin from that PR is already in `.github/actions/setup`,
but the `verifyDepsBeforeRun: false` half is not — and OSS reproduces every
precondition of the regression Luis resolved on the enterprise overlay:

- `ubuntu-24.04-arm` runner in `_build-matrix.yml`, `pr-build-test.yml`,
  `on-release.yml`
- pnpm 11.1.2 (default `verifyDepsBeforeRun=true`)
- `npm version` mutates `package.json` before `pnpm run publish` /
  `pnpm run make`, which makes pnpm 11 trigger a second install pass that
  re-resolves overrides and reruns `postinstall: electron-rebuild`
- overrides moved to `pnpm-workspace.yaml` (upstream PR #2239)

The recent release history matches Luis's documented fingerprint exactly —
v0.35.0-rc.0, v0.35.0-rc.1, v0.35.1-rc.0, v0.35.1, v0.35.3-rc.0, v0.35.3-rc.1
all cancelled or failed on arm. v0.34.x ran on pnpm 10.33.0 (no such setting)
and shipped arm cleanly every time.

Setting `verifyDepsBeforeRun: false` skips the second install pass while
keeping pnpm 11.1.2 (so workspace-level overrides still apply correctly).

Refs: nodejs/node#62253, npm/cli#9118, stacklok/stacklok-enterprise-platform#1243

Author: peppescg

pnpm-workspace.yaml

@@ -1,6 +1,19 @@
 nodeLinker: hoisted
 engineStrict: true
 
+# Disable pnpm 11's pre-script `verify-deps-before-run` install pass. Without
+# this, the `npm version` step in `on-release.yml` / `pr-build-test.yml`
+# (which mutates `package.json`) makes the next `pnpm run publish` /
+# `pnpm run make` trigger a second install pass that re-resolves overrides
+# and reruns `postinstall: electron-rebuild`. On the `ubuntu-24.04-arm`
+# runner that second pass hangs at end-of-install ~90% of the time in
+# interruptible sleep at ~600MB RSS, blocking the job for 30+ min and
+# producing silent cancels (see v0.35.0-rc.0 through v0.35.3-rc.1).
+# v0.34.x ran on pnpm 10.33.0 which didn't have this setting and shipped
+# arm releases first-try every time — disabling it on pnpm 11.x replicates
+# that behavior without touching the lockfile or override resolution.
+verifyDepsBeforeRun: false
+
 allowBuilds:
   '@sentry/cli': true
   '@swc/core': true