Why

Move this repo to a single pnpm workspace lockfile and add stronger dependency-supply-chain controls after the Dependabot churn.

What changed

• Replaced npm lockfiles with one pnpm workspace lockfile.
• Added pnpm 11.3.0 via packageManager and migrated CI/dev scripts to frozen pnpm installs.
• Added pnpm minimum release age settings with a one-off exact exception for @vizzly-testing/honeydiff@0.10.3.
• Added explicit build-script allowlists for canvas, esbuild, node-pty, and odiff-bin.
• Added Dependabot cooldowns for npm ecosystem updates.
• Added pnpm overrides for @babel/runtime, ws, and uuid to clear moderate audit findings.

Verification

• npx pnpm@11.3.0 install --frozen-lockfile
• npx pnpm@11.3.0 audit --audit-level=moderate (passes; 3 low findings remain)
• npx pnpm@11.3.0 run build
• npx pnpm@11.3.0 run format:check
• npx pnpm@11.3.0 run lint
• npx pnpm@11.3.0 run test:types
• npx pnpm@11.3.0 test
• npx pnpm@11.3.0 run test:reporter
• git diff --check

Docker TUI build was attempted, but Docker stalled on node:22-slim metadata resolution before reaching our Dockerfile steps.