fix: make pnpm release installs deterministic

[rogerchappel]

Summary

• Pin pnpm 10.13.1 in package metadata and every package-using workflow.
• Allow esbuild's required install script so frozen non-interactive installs succeed.
• Add an executable drift check and run the complete release gate from main CI.
• Document the exact contributor and release setup.

Verification

• Tests or checks run:
  • CI=true corepack pnpm install --frozen-lockfile
  • corepack pnpm run release:check
  • git diff --check
  • git log --format='%h%x09%an%x09%ae%x09%cn%x09%ce' origin/main..HEAD
• Manual review completed:
  • Confirmed all four pnpm workflow setup versions match packageManager.
  • Confirmed every proposed commit uses Roger Chappel miscanalysis@gmail.com.

Risk Level

• Low
• Medium
• High

Notes: The change affects CI and release preparation, but does not publish or release anything. The exact pnpm pin and policy check fail closed if workflow versions drift.

Rollback Plan

• Revert the four commits to restore the prior package metadata, workflows, and documentation.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other:

Commit Summary

• f0981d8 fix: pin pnpm and allow esbuild installs
• 43a6f5f ci: align workflows with pinned pnpm
• 52dacb6 ci: run package verification on main
• ece6cdd docs: document the pinned release toolchain