build: pin pnpm to v9 in frontend stage

pnpm 10+ promotes the 'Ignored build scripts' warning into an error
when the consumer hasn't approved scripts via package.json's
onlyBuiltDependencies. The frontend lockfile pulls esbuild@0.21.5 and
vue-demi@0.14.10, both of which need postinstall to materialize their
binaries, so a fresh `pnpm install` on v10/v11 dies with:

  [ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: esbuild@0.21.5,
                            vue-demi@0.14.10
  exit code: 1

`pnpm@latest` resolves to whatever is current at build time, so the
Dockerfile builds non-deterministically — it works on v9 (the version
in use when the lockfile was first committed) and fails on v10+. Pin
to v9 so the image keeps building until upstream adopts approve-builds
or pre-declares onlyBuiltDependencies.

NOT a fix to the codex-transform bug — this is purely a build-side
deterministic-Dockerfile change. The fc-underscore PR (Wei-Shaw#2499) is the
real fix and lives on the upstream-bound branch.

Author: yetone

Dockerfile

@@ -21,7 +21,7 @@ FROM ${NODE_IMAGE} AS frontend-builder
 WORKDIR /app/frontend
 
 # Install pnpm
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@9 --activate
 
 # Install dependencies first (better caching)
 COPY frontend/package.json frontend/pnpm-lock.yaml ./