fix(ci): use pnpm 11 allowBuilds instead of onlyBuiltDependencies

pnpm 11 treats ignored build scripts as a hard error during fresh
installs (CI/Docker), while the old onlyBuiltDependencies list is
deprecated. The stray 'allowBuilds: esbuild: set this to true or false'
placeholder was invalid YAML semantics and blocked the esbuild
postinstall, failing 'pnpm install --frozen-lockfile' in the Docker
builder stage (ERR_PNPM_IGNORED_BUILDS).

pnpm-workspace.yaml

@@ -75,11 +75,14 @@ catalog:
 
 autoInstallPeers: false
 
-onlyBuiltDependencies:
-  - '@swc/core'
-  - esbuild
-  - msw
-  - unrs-resolver
+# pnpm 11: allowBuilds (map) replaces onlyBuiltDependencies (list).
+# Build scripts are blocked by default (supply-chain defense). Only allow
+# scripts for packages that genuinely need a postinstall to work.
+allowBuilds:
+  '@swc/core': true
+  esbuild: true
+  msw: true
+  unrs-resolver: true
 
 overrides:
   # replit uses linux-x64 only, we can exclude all other platforms
@@ -174,6 +177,3 @@ overrides:
   linkify-it: ">=5.0.2"
   brace-expansion: ">=5.0.8"
   fast-uri: ">=3.1.4"
-
-allowBuilds:
-  esbuild: set this to true or false