docs: add note about integrity check behavior with trustLockfile

Author: IzumiSy

pnpm-workspace.yaml

@@ -31,6 +31,11 @@ catalog:
 # Trust the lockfile so that already-resolved entries skip the minimumReleaseAge /
 # trustPolicy verification pass. This prevents unrelated packages from failing
 # trust checks when updating a specific dependency.
+#
+# Note: Since pnpm@11.4, tarball integrity mismatches are always a hard error
+# regardless of this setting — a compromised or re-published tarball will still be
+# caught at download time even with trustLockfile enabled. The only check skipped
+# here is the time-based minimumReleaseAge / trustPolicy verification.
 trustLockfile: true
 
 # Require packages to be published for at least 3 days before allowing install (default: 1 day)