Keep pnpm-lock.yaml a single document so Dependabot sees dependencies

[mpsq]

pnpm 12 writes its own pinned version as a first YAML document in pnpm-lock.yaml. GitHub's dependency graph reads only that document, so the SBOM dropped to direct dependencies and Dependabot auto-closed alerts as "fixed" while the vulnerable versions were still locked (dependabot/dependabot-core#15904).

• Set pmOnFail: ignore in pnpm-workspace.yaml so pnpm stops writing that document
• Drop the existing env document from pnpm-lock.yaml; the dependency document is unchanged byte for byte
• CI installs the pinned pnpm through pnpm/setup, which reads packageManager, so CI is unaffected. Locally, pnpm no longer auto-switches to the pinned version

---

Note

Low Risk
Workspace-only pnpm configuration; no application runtime changes, with CI package-manager install path unchanged.

Overview
Restores Dependabot visibility by setting pmOnFail: ignore in pnpm-workspace.yaml, so pnpm 12 stops prepending a separate packageManager document to pnpm-lock.yaml. GitHub’s dependency graph only read that first document, which hid the real lockfile and broke SBOM/alert accuracy (dependabot-core#15904).

Inline comments document why the option exists. CI still gets the pinned pnpm via pnpm/setup and packageManager; locally, pnpm no longer auto-switches to the pinned version when the pin check fails.

^{Reviewed by Cursor Bugbot for commit ec79d65. Bugbot is set up for automated code reviews on this repo. Configure here.}