CI: two footguns — esbuild allowBuilds contradiction + PR build coupled to 7 downstream repos

[CameronBrooks11]

Two genuine CI footguns

1. esbuild build-gate contradiction (S, High): package.json correctly sets pnpm.onlyBuiltDependencies:["esbuild"], but pnpm-workspace.yaml has allowBuilds:{esbuild:false} — an unrecognized pnpm key stating the opposite intent. This is exactly the esbuild-breakage footgun the org has hit before. Fix: net deletion, consolidate into pnpm-workspace.yaml.
2. PR CI hard-coupled to 7 downstream repos (M, High): every PR build clones all 7 repos + fetches each one's latest-release metrics.json unauthenticated, and exit(1) on any miss — so a docs-only PR can red-fail for reasons entirely outside this repo (missing asset, rate limits). Fix: pass GITHUB_TOKEN to the build and/or move the metrics aggregation to a non-blocking lane.

Smaller (minimal-first)

• Orphan .markdownlint-test.json (valid config wired to nothing) → delete or rename + wire.
• Pin pnpm via packageManager; align engines.node (20) with CI (24). pnpm: latest is non-reproducible.

[CameronBrooks11]

Verified — both footguns confirmed (allowBuilds is an unrecognized/inert pnpm key, so esbuild IS allowed, contradicting intent; the PR build hits external GitHub unauthenticated with hard exit(1)). Wording fix: the 7-repo loop in fetch-metrics.mjs fetches release metrics via API (doesn't clone); the actual cloning is in aggregate.mjs + generate-reference.mjs (clone every repo in data/repos.json, exit(1) on miss). All three run inside pnpm build and all hard-fail on any external miss — the docs-only-PR-can-red-fail conclusion holds.

[CameronBrooks11]

Done in PR #21: both footguns fixed (the pnpm premise was inverted — corrected to allowBuilds: {esbuild: true}; metrics fetch authenticated + PR-graceful).